Sign Up
Log In
Log In
or
Sign Up
Places
All Projects
Status Monitor
Collapse sidebar
SUSE:SLE-15-SP2:Update
busybox-static.20467
udhcpc-check-that-4-byte-options-are-indeed-4-b...
Overview
Repositories
Revisions
Requests
Users
Attributes
Meta
File udhcpc-check-that-4-byte-options-are-indeed-4-byte-closes-11506.patch of Package busybox-static.20467
From: Denys Vlasenko <vda.linux@googlemail.com> Date: Mon Dec 17 18:07:18 2018 +0100 Subject: udhcpc: check that 4-byte options are indeed 4-byte, closes 11506 Patch-mainline: 6d3b4bb24da9a07c263f3c1acf8df85382ff562c Git-repo: https://git.busybox.net/busybox Git-commit: 8bc832d4b03a9b2091da8c8c114683289977b241 References: function old new delta udhcp_get_option32 - 27 +27 udhcp_get_option 231 248 +17 ------------------------------------------------------------------------------ (add/remove: 1/0 grow/shrink: 1/0 up/down: 44/0) Total: 44 bytes Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com> Signed-off-by: Egbert Eich <eich@suse.de> --- networking/udhcp/common.c | 19 +++++++++++++++++++ networking/udhcp/common.h | 4 ++++ networking/udhcp/dhcpc.c | 6 +++--- networking/udhcp/dhcpd.c | 6 +++--- 4 files changed, 29 insertions(+), 6 deletions(-) diff --git a/networking/udhcp/common.c b/networking/udhcp/common.c index 1aaf5255c..95900da73 100644 --- a/networking/udhcp/common.c +++ b/networking/udhcp/common.c @@ -263,6 +263,15 @@ uint8_t* FAST_FUNC udhcp_get_option(struct dhcp_packet *packet, int code) goto complain; /* complain and return NULL */ if (optionptr[OPT_CODE] == code) { + if (optionptr[OPT_LEN] == 0) { + /* So far no valid option with length 0 known. + * Having this check means that searching + * for DHCP_MESSAGE_TYPE need not worry + * that returned pointer might be unsafe + * to dereference. + */ + goto complain; /* complain and return NULL */ + } log_option("option found", optionptr); return optionptr + OPT_DATA; } @@ -280,6 +289,16 @@ uint8_t* FAST_FUNC udhcp_get_option(struct dhcp_packet *packet, int code) return NULL; } +uint8_t* FAST_FUNC udhcp_get_option32(struct dhcp_packet *packet, int code) +{ + uint8_t *r = udhcp_get_option(packet, code); + if (r) { + if (r[-1] != 4) + r = NULL; + } + return r; +} + /* Return the position of the 'end' option (no bounds checking) */ int FAST_FUNC udhcp_end_option(uint8_t *optionptr) { diff --git a/networking/udhcp/common.h b/networking/udhcp/common.h index a526494d7..1e89351c6 100644 --- a/networking/udhcp/common.h +++ b/networking/udhcp/common.h @@ -196,6 +196,10 @@ extern const uint8_t dhcp_option_lengths[] ALIGN1; unsigned FAST_FUNC udhcp_option_idx(const char *name); uint8_t *udhcp_get_option(struct dhcp_packet *packet, int code) FAST_FUNC; +/* Same as above + ensures that option length is 4 bytes + * (returns NULL if size is different) + */ +uint8_t *udhcp_get_option32(struct dhcp_packet *packet, int code) FAST_FUNC; int udhcp_end_option(uint8_t *optionptr) FAST_FUNC; void udhcp_add_binary_option(struct dhcp_packet *packet, uint8_t *addopt) FAST_FUNC; void udhcp_add_simple_option(struct dhcp_packet *packet, uint8_t code, uint32_t data) FAST_FUNC; diff --git a/networking/udhcp/dhcpc.c b/networking/udhcp/dhcpc.c index 0e236261b..cc8c0d6d3 100644 --- a/networking/udhcp/dhcpc.c +++ b/networking/udhcp/dhcpc.c @@ -1704,7 +1704,7 @@ int udhcpc_main(int argc UNUSED_PARAM, char **argv) * They say ISC DHCP client supports this case. */ server_addr = 0; - temp = udhcp_get_option(&packet, DHCP_SERVER_ID); + temp = udhcp_get_option32(&packet, DHCP_SERVER_ID); if (!temp) { bb_error_msg("no server ID, using 0.0.0.0"); } else { @@ -1731,7 +1731,7 @@ int udhcpc_main(int argc UNUSED_PARAM, char **argv) struct in_addr temp_addr; uint8_t *temp; - temp = udhcp_get_option(&packet, DHCP_LEASE_TIME); + temp = udhcp_get_option32(&packet, DHCP_LEASE_TIME); if (!temp) { bb_error_msg("no lease time with ACK, using 1 hour lease"); lease_seconds = 60 * 60; @@ -1823,7 +1823,7 @@ int udhcpc_main(int argc UNUSED_PARAM, char **argv) uint32_t svid; uint8_t *temp; - temp = udhcp_get_option(&packet, DHCP_SERVER_ID); + temp = udhcp_get_option32(&packet, DHCP_SERVER_ID); if (!temp) { non_matching_svid: log1("received DHCP NAK with wrong" diff --git a/networking/udhcp/dhcpd.c b/networking/udhcp/dhcpd.c index e116ba3af..f72936d54 100644 --- a/networking/udhcp/dhcpd.c +++ b/networking/udhcp/dhcpd.c @@ -633,7 +633,7 @@ static void add_server_options(struct dhcp_packet *packet) static uint32_t select_lease_time(struct dhcp_packet *packet) { uint32_t lease_time_sec = server_config.max_lease_sec; - uint8_t *lease_time_opt = udhcp_get_option(packet, DHCP_LEASE_TIME); + uint8_t *lease_time_opt = udhcp_get_option32(packet, DHCP_LEASE_TIME); if (lease_time_opt) { move_from_unaligned32(lease_time_sec, lease_time_opt); lease_time_sec = ntohl(lease_time_sec); @@ -967,7 +967,7 @@ int udhcpd_main(int argc UNUSED_PARAM, char **argv) } /* Get SERVER_ID if present */ - server_id_opt = udhcp_get_option(&packet, DHCP_SERVER_ID); + server_id_opt = udhcp_get_option32(&packet, DHCP_SERVER_ID); if (server_id_opt) { uint32_t server_id_network_order; move_from_unaligned32(server_id_network_order, server_id_opt); @@ -991,7 +991,7 @@ int udhcpd_main(int argc UNUSED_PARAM, char **argv) } /* Get REQUESTED_IP if present */ - requested_ip_opt = udhcp_get_option(&packet, DHCP_REQUESTED_IP); + requested_ip_opt = udhcp_get_option32(&packet, DHCP_REQUESTED_IP); if (requested_ip_opt) { move_from_unaligned32(requested_nip, requested_ip_opt); }
Locations
Projects
Search
Status Monitor
Help
OpenBuildService.org
Documentation
API Documentation
Code of Conduct
Contact
Support
@OBShq
Terms
openSUSE Build Service is sponsored by
The Open Build Service is an
openSUSE project
.
Sign Up
Log In
Places
Places
All Projects
Status Monitor
