diff options
| author | Denys Vlasenko | 2016-10-25 14:25:52 +0200 |
|---|---|---|
| committer | Denys Vlasenko | 2016-10-25 14:26:36 +0200 |
| commit | f11c6989ba40f6bed8c4b4f0b6b7578aba3a63f9 (patch) | |
| tree | 20c54a24c76325e62828f07781643a430104ad6e | |
| parent | f9beeb22e2a4128ed85a8dc267d0823e5cfd3f47 (diff) | |
| download | busybox-f11c6989ba40f6bed8c4b4f0b6b7578aba3a63f9.zip busybox-f11c6989ba40f6bed8c4b4f0b6b7578aba3a63f9.tar.gz | |
udhcpc: check read of overload option data byte to be within packet
function old new delta
udhcp_get_option 220 225 +5
Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
| -rw-r--r-- | networking/udhcp/common.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/networking/udhcp/common.c b/networking/udhcp/common.c index 589bcd6..1aaf525 100644 --- a/networking/udhcp/common.c +++ b/networking/udhcp/common.c @@ -268,7 +268,8 @@ uint8_t* FAST_FUNC udhcp_get_option(struct dhcp_packet *packet, int code) } if (optionptr[OPT_CODE] == DHCP_OPTION_OVERLOAD) { - overload |= optionptr[OPT_DATA]; + if (len >= 3) + overload |= optionptr[OPT_DATA]; /* fall through */ } optionptr += len; |