diff options
| author | Kevin Darbyshire-Bryant | 2020-04-24 10:18:26 +0000 |
|---|---|---|
| committer | Kevin Darbyshire-Bryant | 2020-04-24 10:18:34 +0000 |
| commit | f4d759be54ceb37714e9a6ca320d5b50c95e9ce9 (patch) | |
| tree | 579535e44785442c088542dcf10da46c44c245ca | |
| parent | 796da66abd074037f3b48475772d65874cc6de54 (diff) | |
| download | relayd-f4d759be54ceb37714e9a6ca320d5b50c95e9ce9.tar.gz | |
dhcp.c: further improve validation
Add 2 more length/bounds checks with thanks to
Guido Vranken <guido@guidovranken.com>
Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
| -rw-r--r-- | dhcp.c | 5 |
1 files changed, 4 insertions, 1 deletions
@@ -94,6 +94,8 @@ parse_dhcp_options(struct relayd_host *host, struct dhcp_header *dhcp, int len) break; opt = (void *) &opt->data[opt->len]; + if ((uint8_t *) opt + sizeof(*opt) > end ) + break; switch(opt->code) { case DHCP_OPTION_ROUTER: DPRINTF(2, "Found a DHCP router option, len=%d\n", opt->len); @@ -137,7 +139,8 @@ bool relayd_handle_dhcp_packet(struct relayd_interface *rif, void *data, int len udp = (void *) ((char *) &pkt->iph + (pkt->iph.ihl << 2)); dhcp = (void *) (udp + 1); - if ((uint8_t *)udp + sizeof(*udp) > (uint8_t *)data + len ) + if ((uint8_t *)udp + sizeof(*udp) > (uint8_t *)data + len || + (uint8_t *)dhcp + sizeof(*dhcp) > (uint8_t *)data + len) return false; udplen = ntohs(udp->len); |