summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorDenys Vlasenko2020-01-14 17:05:48 +0100
committerDenys Vlasenko2020-01-14 17:07:18 +0100
commit020abc8856f94d6e355f4daa972ac75fb05ae113 (patch)
tree80b17c194d00325fb131d61da4a1876d9f9cba9f
parent9ec836c033fc6e55e80f3309b3e05acdf09bb297 (diff)
downloadbusybox-020abc8856f94d6e355f4daa972ac75fb05ae113.zip
busybox-020abc8856f94d6e355f4daa972ac75fb05ae113.tar.gz
udhcpd: mangle hostnames starting with dash ("-option")
function old new delta add_lease 316 328 +12 Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
-rw-r--r--networking/udhcp/dhcpd.c2
1 files changed, 2 insertions, 0 deletions
diff --git a/networking/udhcp/dhcpd.c b/networking/udhcp/dhcpd.c
index 3e08ec0..9d66049 100644
--- a/networking/udhcp/dhcpd.c
+++ b/networking/udhcp/dhcpd.c
@@ -192,6 +192,8 @@ static struct dyn_lease *add_lease(
* but merely make dumpleases output safe for shells to use.
* We accept "0-9A-Za-z._-", all other chars turn to dots.
*/
+ if (*p == '-')
+ *p = '.'; /* defeat "-option" attacks too */
while (*p) {
if (!isalnum(*p) && *p != '-' && *p != '_')
*p = '.';