summaryrefslogtreecommitdiff
path: root/networking/udhcp/common.c
diff options
context:
space:
mode:
authorDenys Vlasenko2016-10-25 14:25:52 +0200
committerDenys Vlasenko2016-10-25 14:26:36 +0200
commitf11c6989ba40f6bed8c4b4f0b6b7578aba3a63f9 (patch)
tree20c54a24c76325e62828f07781643a430104ad6e /networking/udhcp/common.c
parentf9beeb22e2a4128ed85a8dc267d0823e5cfd3f47 (diff)
downloadbusybox-f11c6989ba40f6bed8c4b4f0b6b7578aba3a63f9.zip
busybox-f11c6989ba40f6bed8c4b4f0b6b7578aba3a63f9.tar.gz
udhcpc: check read of overload option data byte to be within packet
function old new delta udhcp_get_option 220 225 +5 Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
Diffstat (limited to 'networking/udhcp/common.c')
-rw-r--r--networking/udhcp/common.c3
1 files changed, 2 insertions, 1 deletions
diff --git a/networking/udhcp/common.c b/networking/udhcp/common.c
index 589bcd6..1aaf525 100644
--- a/networking/udhcp/common.c
+++ b/networking/udhcp/common.c
@@ -268,7 +268,8 @@ uint8_t* FAST_FUNC udhcp_get_option(struct dhcp_packet *packet, int code)
}
if (optionptr[OPT_CODE] == DHCP_OPTION_OVERLOAD) {
- overload |= optionptr[OPT_DATA];
+ if (len >= 3)
+ overload |= optionptr[OPT_DATA];
/* fall through */
}
optionptr += len;