mirror of
https://github.com/freebsd/freebsd-src
synced 2024-10-15 12:54:27 +00:00
dhclient(8): Verify lease-, renewal- and rebinding-time option sizes.
Else out-of-bound reads and undefined behaviour may happen. The current code only checked for the presence of the first of four bytes. Make sure the fields in question have the minium size required. No functional change intended. Reviewed by: rrs@ MFC after: 1 week Sponsored by: NVIDIA Networking
This commit is contained in:
parent
84b0b7ea4c
commit
3492caf512
|
@ -798,7 +798,7 @@ dhcpack(struct packet *packet)
|
|||
ACTION_SUPERSEDE)
|
||||
ip->client->new->expiry = getULong(
|
||||
ip->client->config->defaults[DHO_DHCP_LEASE_TIME].data);
|
||||
else if (ip->client->new->options[DHO_DHCP_LEASE_TIME].data)
|
||||
else if (ip->client->new->options[DHO_DHCP_LEASE_TIME].len >= 4)
|
||||
ip->client->new->expiry = getULong(
|
||||
ip->client->new->options[DHO_DHCP_LEASE_TIME].data);
|
||||
else
|
||||
|
@ -821,7 +821,7 @@ dhcpack(struct packet *packet)
|
|||
ACTION_SUPERSEDE)
|
||||
ip->client->new->renewal = getULong(
|
||||
ip->client->config->defaults[DHO_DHCP_RENEWAL_TIME].data);
|
||||
else if (ip->client->new->options[DHO_DHCP_RENEWAL_TIME].len)
|
||||
else if (ip->client->new->options[DHO_DHCP_RENEWAL_TIME].len >= 4)
|
||||
ip->client->new->renewal = getULong(
|
||||
ip->client->new->options[DHO_DHCP_RENEWAL_TIME].data);
|
||||
else
|
||||
|
@ -835,7 +835,7 @@ dhcpack(struct packet *packet)
|
|||
ACTION_SUPERSEDE)
|
||||
ip->client->new->rebind = getULong(
|
||||
ip->client->config->defaults[DHO_DHCP_REBINDING_TIME].data);
|
||||
else if (ip->client->new->options[DHO_DHCP_REBINDING_TIME].len)
|
||||
else if (ip->client->new->options[DHO_DHCP_REBINDING_TIME].len >= 4)
|
||||
ip->client->new->rebind = getULong(
|
||||
ip->client->new->options[DHO_DHCP_REBINDING_TIME].data);
|
||||
else
|
||||
|
|
Loading…
Reference in a new issue