When finished pulling an option out of a buffer, skip directly to the

next option. Don't rely on truncated NULs being ignored because
NUL == DHO_PAD.

ok tb@

1 files changed, 2 insertions, 2 deletions

diff --git a/sbin/dhclient/options.c b/sbin/dhclient/options.c
index 5753fd01046..9a6c245799a 100644
--- a/sbin/dhclient/options.c
+++ b/sbin/dhclient/options.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: options.c,v 1.110 2018/07/21 15:24:55 krw Exp $	*/
+/*	$OpenBSD: options.c,v 1.111 2018/07/22 08:43:01 krw Exp $	*/
 
 /* DHCP options parsing and reassembly. */
 
@@ -489,7 +489,7 @@ parse_option_buffer(struct option_data *options, unsigned char *buffer,
 			free(options[code].data);
 			options[code].data = t;
 		}
-		s += len + 2;
+		s += s[1] + 2;
 	}
 
 	return 1;