Skip to content

Commit

Permalink
Move dhcp(v4) packet size check earlier (#295)
Browse files Browse the repository at this point in the history
dhcp_handlebootp handled zero sized packets correctly, but
dhcp_redirect_dhcp did not have such protection. Move size check before
both of them. Size when called from dhcp_packet is checked by
is_packet_udp_bootp call. Only dhcp_recvmsg needs earlier checking to be
added.

Fixes #283
  • Loading branch information
pemensik authored Feb 16, 2024
1 parent 8ab7ca1 commit 727c78f
Showing 1 changed file with 7 additions and 6 deletions.
13 changes: 7 additions & 6 deletions src/dhcp.c
Original file line number Diff line number Diff line change
Expand Up @@ -3532,12 +3532,6 @@ dhcp_handlebootp(struct interface *ifp, struct bootp *bootp, size_t len,
{
size_t v;

if (len < offsetof(struct bootp, vend)) {
logerrx("%s: truncated packet (%zu) from %s",
ifp->name, len, inet_ntoa(*from));
return;
}

/* Unlikely, but appeases sanitizers. */
if (len > FRAMELEN_MAX) {
logerrx("%s: packet exceeded frame length (%zu) from %s",
Expand Down Expand Up @@ -3670,6 +3664,13 @@ dhcp_recvmsg(struct dhcpcd_ctx *ctx, struct msghdr *msg)
logerr(__func__);
return;
}

if (iov->iov_len < offsetof(struct bootp, vend)) {
logerrx("%s: truncated packet (%zu) from %s",
ifp->name, iov->iov_len, inet_ntoa(from->sin_addr));
return;
}

state = D_CSTATE(ifp);
if (state == NULL) {
/* Try re-directing it to another interface. */
Expand Down

0 comments on commit 727c78f

Please sign in to comment.