dhcp: be more careful when parsing strings from DHCP packets

Let's make sure there's no embedded 0 byte. Also, let's reset the string
if the length is zero.

1 files changed, 6 insertions, 2 deletions

diff --git a/src/libsystemd-network/sd-dhcp-lease.c b/src/libsystemd-network/sd-dhcp-lease.c
index f5b9e22589..57369a353d 100644
--- a/src/libsystemd-network/sd-dhcp-lease.c
+++ b/src/libsystemd-network/sd-dhcp-lease.c
@@ -287,13 +287,17 @@ static int lease_parse_string(const uint8_t *option, size_t len, char **ret) {
         if (len >= 1) {
                 char *string;
 
+                if (memchr(option, 0, len))
+                        return -EINVAL;
+
                 string = strndup((const char *)option, len);
                 if (!string)
-                        return -errno;
+                        return -ENOMEM;
 
                 free(*ret);
                 *ret = string;
-        }
+        } else
+                *ret = mfree(*ret);
 
         return 0;
 }