summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorLennart Poettering <lennart@poettering.net>2016-05-30 18:28:51 +0200
committerLennart Poettering <lennart@poettering.net>2016-05-30 18:28:51 +0200
commit76a9d0f1713a39471ea6c85e982fb0b447ef1315 (patch)
treea12b9bc7d9e20e63145795a9ea26395c528f4c8d
parentac96418b4f16c2a0acd2e4981e533c00fe21bdf1 (diff)
dhcp-server: fix integer underflow
Let's better ignore an invalid message size parameter, than assume ridiculously larger sizes.
-rw-r--r--src/libsystemd-network/sd-dhcp-server.c3
1 files changed, 2 insertions, 1 deletions
diff --git a/src/libsystemd-network/sd-dhcp-server.c b/src/libsystemd-network/sd-dhcp-server.c
index a1af5da40f..ea4f03df1d 100644
--- a/src/libsystemd-network/sd-dhcp-server.c
+++ b/src/libsystemd-network/sd-dhcp-server.c
@@ -633,7 +633,8 @@ static int parse_request(uint8_t code, uint8_t len, const void *option, void *us
break;
case SD_DHCP_OPTION_MAXIMUM_MESSAGE_SIZE:
- if (len == 2)
+
+ if (len == 2 && unaligned_read_be16(option) >= sizeof(DHCPPacket))
req->max_optlen = unaligned_read_be16(option) - sizeof(DHCPPacket);
break;