d/freebsd-dev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Free DHCP options with length zero.

Browse Source 
Otherwise they are leaked, allowing an attacker to trigger memory
exhaustion.

This is options.c rev. 1.70 from OpenBSD.

admbugs:	552
Obtained from:	OpenBSD
MFC after:	3 days
This commit is contained in:
Mark Johnston 2019-06-26 20:19:48 +00:00
parent a3ae40c7a4
commit 5baf985da7
Notes: svn2git 2020-12-20 02:59:44 +00:00 
svn path=/head/; revision=349439
1 changed files with 1 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
sbin/dhclient/options.c
View File

@ -896,6 +896,5 @@ do_packet(struct interface_info *interface, struct dhcp_packet *packet,
/* Free the data associated with the options. */
for (i = 0; i < 256; i++)
if (tp.options[i].len && tp.options[i].data)
free(tp.options[i].data);
free(tp.options[i].data);
}