d/freebsd-dev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

dhclient(8): Verify lease-, renewal- and rebinding-time option sizes.

Browse Source 
Else out-of-bound reads and undefined behaviour may happen.
The current code only checked for the presence of the first of four bytes.
Make sure the fields in question have the minium size required.

No functional change intended.

Reviewed by:	rrs@
MFC after:	1 week
Sponsored by:	NVIDIA Networking
This commit is contained in:
Hans Petter Selasky 2022-11-14 15:20:09 +01:00
parent 84b0b7ea4c
commit 3492caf512
1 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
sbin/dhclient/dhclient.c
View File

@ -798,7 +798,7 @@ dhcpack(struct packet *packet)
ACTION_SUPERSEDE)
ip->client->new->expiry = getULong(
ip->client->config->defaults[DHO_DHCP_LEASE_TIME].data);
else if (ip->client->new->options[DHO_DHCP_LEASE_TIME].data)
else if (ip->client->new->options[DHO_DHCP_LEASE_TIME].len >= 4)
ip->client->new->expiry = getULong(
ip->client->new->options[DHO_DHCP_LEASE_TIME].data);
else
@ -821,7 +821,7 @@ dhcpack(struct packet *packet)
ACTION_SUPERSEDE)
ip->client->new->renewal = getULong(
ip->client->config->defaults[DHO_DHCP_RENEWAL_TIME].data);
else if (ip->client->new->options[DHO_DHCP_RENEWAL_TIME].len)
else if (ip->client->new->options[DHO_DHCP_RENEWAL_TIME].len >= 4)
ip->client->new->renewal = getULong(
ip->client->new->options[DHO_DHCP_RENEWAL_TIME].data);
else
@ -835,7 +835,7 @@ dhcpack(struct packet *packet)
ACTION_SUPERSEDE)
ip->client->new->rebind = getULong(
ip->client->config->defaults[DHO_DHCP_REBINDING_TIME].data);
else if (ip->client->new->options[DHO_DHCP_REBINDING_TIME].len)
else if (ip->client->new->options[DHO_DHCP_REBINDING_TIME].len >= 4)
ip->client->new->rebind = getULong(
ip->client->new->options[DHO_DHCP_REBINDING_TIME].data);
else