abc/lwip
1
0
Fork 0
mirror of https://git.savannah.nongnu.org/git/lwip.git synced 2026-08-10 17:43:39 +08:00
Code Issues Packages Projects Releases Wiki Activity

Segfault in dhcp_parse_reply if no end marker

Browse Source 
If no endmarker is present in a dhcp reply a null pointer is potentially
dereferenced.

Add fix and test case as proof of concept.
This commit is contained in:
Henrik Persson
2012-08-30 13:57:33 +02:00
committed by goldsimon
parent 150b4fb4f6
commit 7e9f000d0b
2 changed files with 114 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
src/core/dhcp.c
View File

@@ -1472,8 +1472,14 @@ decode_next:
if (offset >= q->len) {
offset -= q->len;
offset_max -= q->len;
q = q->next;
options = (u8_t*)q->payload;
if (offset < offset_max && offset_max) {
q = q->next;
LWIP_ASSERT("next pbuf was null", q);
options = (u8_t*)q->payload;
} else {
// We've run out of bytes, probably no end marker. Don't proceed.
break;
}
}
}
/* is this an overloaded message? */