git: 906f88a5d67c - stable/11 - dhclient(8): Verify lease-, renewal- and rebinding-time option sizes.
- Go to: [ bottom of page ] [ top of archives ] [ this month ]
Date: Mon, 21 Nov 2022 20:52:07 UTC
The branch stable/11 has been updated by hselasky:
URL: https://cgit.FreeBSD.org/src/commit/?id=906f88a5d67cab3e3a81b8d584f5abdaa15b2360
commit 906f88a5d67cab3e3a81b8d584f5abdaa15b2360
Author: Hans Petter Selasky <hselasky@FreeBSD.org>
AuthorDate: 2022-11-14 14:20:09 +0000
Commit: Hans Petter Selasky <hselasky@FreeBSD.org>
CommitDate: 2022-11-21 20:51:18 +0000
dhclient(8): Verify lease-, renewal- and rebinding-time option sizes.
Else out-of-bound reads and undefined behaviour may happen.
The current code only checked for the presence of the first of four bytes.
Make sure the fields in question have the minium size required.
No functional change intended.
Reviewed by: rrs@
Sponsored by: NVIDIA Networking
(cherry picked from commit 3492caf512ae090816b4ffa275be43b2f5cfc460)
---
sbin/dhclient/dhclient.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/sbin/dhclient/dhclient.c b/sbin/dhclient/dhclient.c
index 7ca9cfe8ab42..a8293fcd7cf5 100644
--- a/sbin/dhclient/dhclient.c
+++ b/sbin/dhclient/dhclient.c
@@ -764,7 +764,7 @@ dhcpack(struct packet *packet)
ACTION_SUPERSEDE)
ip->client->new->expiry = getULong(
ip->client->config->defaults[DHO_DHCP_LEASE_TIME].data);
- else if (ip->client->new->options[DHO_DHCP_LEASE_TIME].data)
+ else if (ip->client->new->options[DHO_DHCP_LEASE_TIME].len >= 4)
ip->client->new->expiry = getULong(
ip->client->new->options[DHO_DHCP_LEASE_TIME].data);
else
@@ -787,7 +787,7 @@ dhcpack(struct packet *packet)
ACTION_SUPERSEDE)
ip->client->new->renewal = getULong(
ip->client->config->defaults[DHO_DHCP_RENEWAL_TIME].data);
- else if (ip->client->new->options[DHO_DHCP_RENEWAL_TIME].len)
+ else if (ip->client->new->options[DHO_DHCP_RENEWAL_TIME].len >= 4)
ip->client->new->renewal = getULong(
ip->client->new->options[DHO_DHCP_RENEWAL_TIME].data);
else
@@ -801,7 +801,7 @@ dhcpack(struct packet *packet)
ACTION_SUPERSEDE)
ip->client->new->rebind = getULong(
ip->client->config->defaults[DHO_DHCP_REBINDING_TIME].data);
- else if (ip->client->new->options[DHO_DHCP_REBINDING_TIME].len)
+ else if (ip->client->new->options[DHO_DHCP_REBINDING_TIME].len >= 4)
ip->client->new->rebind = getULong(
ip->client->new->options[DHO_DHCP_REBINDING_TIME].data);
else