d368f3f78
Denys Vlasenko
2026-03-12
Subject
udhcpc6: check the size of D6_OPT_IAPREFIX option
Binary
No binary (build failed)
Architecture & Compiler Flags
gcc -Wp,-MD,applets/.usage.d -Wall -Wstrict-prototypes -O2 -fomit-frame-pointer -Iinclude -Iinclude -o applets/usage applets/usage.c
Build Log
(log yok)
Commit Diff GitHub →
networking/udhcp/d6_dhcpc.c+5 -2
| @@ -305,8 +305,8 @@ static void option_to_env(const uint8_t *option, const uint8_t *option_end) | |
| * | valid-lifetime | | |
| * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | |
| */ | |
| - | /* Make sure payload contains an address */ |
| - | if (option[3] < 24) |
| + | /* Make sure payload exists */ |
| + | if (option[3] < (16 + 4 + 4)) |
| break; | |
| sprint_nip6(ipv6str, option + 4); | |
| @@ -350,6 +350,9 @@ static void option_to_env(const uint8_t *option, const uint8_t *option_end) | |
| * | | | |
| * +-+-+-+-+-+-+-+-+ | |
| */ | |
| + | /* Make sure payload exists */ |
| + | if (option[3] < (4 + 4 + 1 + 16)) |
| + | break; |
| move_from_unaligned32(v32, option + 4 + 4); | |
| v32 = ntohl(v32); | |
| *new_env() = xasprintf("ipv6prefix_lease=%u", (unsigned)v32); | |