diff options
| author | Lennart Poettering <lennart@poettering.net> | 2016-05-30 18:28:51 +0200 |
|---|---|---|
| committer | Lennart Poettering <lennart@poettering.net> | 2016-05-30 18:28:51 +0200 |
| commit | 76a9d0f1713a39471ea6c85e982fb0b447ef1315 (patch) | |
| tree | a12b9bc7d9e20e63145795a9ea26395c528f4c8d /src/libsystemd-network/sd-dhcp-server.c | |
| parent | ac96418b4f16c2a0acd2e4981e533c00fe21bdf1 (diff) | |
dhcp-server: fix integer underflow
Let's better ignore an invalid message size parameter, than assume ridiculously
larger sizes.
Diffstat (limited to 'src/libsystemd-network/sd-dhcp-server.c')
| -rw-r--r-- | src/libsystemd-network/sd-dhcp-server.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/src/libsystemd-network/sd-dhcp-server.c b/src/libsystemd-network/sd-dhcp-server.c index a1af5da40f..ea4f03df1d 100644 --- a/src/libsystemd-network/sd-dhcp-server.c +++ b/src/libsystemd-network/sd-dhcp-server.c @@ -633,7 +633,8 @@ static int parse_request(uint8_t code, uint8_t len, const void *option, void *us break; case SD_DHCP_OPTION_MAXIMUM_MESSAGE_SIZE: - if (len == 2) + + if (len == 2 && unaligned_read_be16(option) >= sizeof(DHCPPacket)) req->max_optlen = unaligned_read_be16(option) - sizeof(DHCPPacket); break; |