From nobody Thu Oct 15 15:24:20 2026 X-Original-To: dev-commits-src-main@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4j5Bgn2JY4z6wBcN for ; Thu, 15 Oct 2026 15:24:21 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4j5Bgn126wz4Kn0 for ; Thu, 15 Oct 2026 15:24:21 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1792077861; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=k1Zr6f2vXc6zY1KBMHO+yMimSZUcTske9814cYSmE9o=; b=RTY2lJwpx4Gw/CUvAzANVQF7Z296YKNxhufX9xg/RKmzwuWIYbq+1fh40lRo9uBKfKlaae ih6xk7ZqeRtx3BIqBIjj00xG8EzJl3syJCOlAcmVIXJgA+4Aw1ey+v0zc6NQilpJ3rHLQB Aq83uIomVoLO0hZdk5qYATNoT965c9DAwXSurO2V/fL0HGpfLBfsNYiXUBCeAHeu7ZUaXI k/9svZIFUJxxaiGBdl3YDkym6yqAhl/6KtrckA6Z85i5ZKHuAGbLGhR2IDrq+oMYprAgy6 klN3nOhNbq0PwK+VT3qpyU/LVmeA4iJZhnaYTO0qad6+b5KEggOeQ6NP3uAP4g== ARC-Seal: i=1; a=rsa-sha256; d=freebsd.org; s=dkim; cv=none; t=1792077861; b=pJZ3ekiZ6SMQE99FqaeCwV742Qm0Y0Fdm59xqeHiC6/tAh7VE/8ztSdlnO4uVlqZMQraPt 9ilzLR75D0lBM8v1Qss6yIoE8TtmscB6i+jszKT2CM/7Y+WpNdwotZ848JwuIh2hli1roa p0xsXNuU5rRQlVgBJXmw4BO2DaDnJ/vodiS+jzX4VdSfv1h1+xGwSrxspjUXF+fIpN6e58 sD/zaL2ssntJs0aClL2Nq5SOuI0pkEmhYfuxSGD6o9HI46SLPdb+37YSOqG/+f4MZjWESM gOHY8Ub2aYG1ZwfAiKevk3An4Mk/8bG/OUymsRRNa/vwSL9E/kz4dkae45fqBA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1792077861; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=k1Zr6f2vXc6zY1KBMHO+yMimSZUcTske9814cYSmE9o=; b=mcduKz+O8BJ69EoviykljPHEaHOSi85AKMqLR2NU0xQwB2IXPH97RBMI5ZRDolmxl4EE8V JiSHyh2UYZJ5VDew+bxN/go5/TCBkbocj5kMyBj4W0fg9zbwMKzdlYyZ5JBFLsY/PkECob sWy1YhJ/FBChlhzmHTHIxhi1FaDeCdjfiIcnuS8LC5eSp4UXLXrMXNYr7S7CoVjiTRmKjn Qb4/EvMuuO227R6Mgtg05f1TCUs0CEgoJQdwf600Rz8u2cq+8J+Zrxs/GRiwE+XM9G4kG+ ERZDO1Qfd2sOrZ8A6/TWXeehk6Mv48X3YJwdHYFEl/N27M4l8sjUp+6gdUHR5g== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4j5Bgm6wLmzfhG for ; Thu, 15 Oct 2026 15:24:20 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 377df by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Thu, 15 Oct 2026 15:24:20 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Mark Johnston Subject: git: 368a1bfcd493 - main - dhclient: Avoid out-of-bounds reads in check_classless_option() List-Archive: https://lists.freebsd.org/archives/dev-commits-src-main X-BeenThere: dev-commits-src-main@freebsd.org Sender: owner-dev-commits-src-main@FreeBSD.org List-Id: Commit messages for the main branch of the src repository List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 368a1bfcd49315e8dd3e56ca6744ce5d74ef737b Auto-Submitted: auto-generated Date: Thu, 15 Oct 2026 15:24:20 +0000 Message-Id: <6ad0f024.377df.47d7c109@gitrepo.freebsd.org> The branch main has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=368a1bfcd49315e8dd3e56ca6744ce5d74ef737b commit 368a1bfcd49315e8dd3e56ca6744ce5d74ef737b Author: Mark Johnston AuthorDate: 2026-10-14 21:12:42 +0000 Commit: Mark Johnston CommitDate: 2026-10-15 14:50:33 +0000 dhclient: Avoid out-of-bounds reads in check_classless_option() The loop did not verify that the option buffer is large enough before reading an address. Reported by: Andrew Griffiths MFC after: 2 weeks Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D60484 --- sbin/dhclient/dhclient.c | 64 ++++++++++++++++++++++++++++-------------------- 1 file changed, 38 insertions(+), 26 deletions(-) diff --git a/sbin/dhclient/dhclient.c b/sbin/dhclient/dhclient.c index bef956645b85..8fccac182c16 100644 --- a/sbin/dhclient/dhclient.c +++ b/sbin/dhclient/dhclient.c @@ -139,7 +139,7 @@ struct sockaddr *get_ifa(char *, int); void routehandler(struct protocol *); void usage(void); int check_option(struct client_lease *l, int option); -int check_classless_option(unsigned char *data, int len); +int check_classless_option(unsigned char *data, size_t len); int ipv4addrs(const char * buf); int res_hnok(const char *dn); int check_search(const char *srch); @@ -2846,43 +2846,56 @@ check_option(struct client_lease *l, int option) /* RFC 3442 The Classless Static Routes option checks */ int -check_classless_option(unsigned char *data, int len) +check_classless_option(unsigned char *data, size_t len) { - int i = 0; - unsigned char width; + unsigned int i; in_addr_t addr, mask; + unsigned char width; if (len < 5) { - warning("Too small length: %d", len); + warning("Too small length: %zu", len); return (0); } - while(i < len) { + for (i = 0; i < len; i += 4) { + unsigned int octets; + width = data[i++]; - if (width == 0) { - i += 4; + octets = (width + 7) / 8; + if (len < i + octets) { + warning("Incorrect data length: %zu", len); + return (0); + } + + switch (octets) { + case 0: continue; - } else if (width < 9) { - addr = (in_addr_t)(data[i] << 24); + case 1: + addr = ((in_addr_t)data[i] << 24); i += 1; - } else if (width < 17) { - addr = (in_addr_t)(data[i] << 24) + - (in_addr_t)(data[i + 1] << 16); + break; + case 2: + addr = ((in_addr_t)data[i] << 24) + + ((in_addr_t)data[i + 1] << 16); i += 2; - } else if (width < 25) { - addr = (in_addr_t)(data[i] << 24) + - (in_addr_t)(data[i + 1] << 16) + - (in_addr_t)(data[i + 2] << 8); + break; + case 3: + addr = ((in_addr_t)data[i] << 24) + + ((in_addr_t)data[i + 1] << 16) + + ((in_addr_t)data[i + 2] << 8); i += 3; - } else if (width < 33) { - addr = (in_addr_t)(data[i] << 24) + - (in_addr_t)(data[i + 1] << 16) + - (in_addr_t)(data[i + 2] << 8) + - data[i + 3]; + break; + case 4: + addr = ((in_addr_t)data[i] << 24) + + ((in_addr_t)data[i + 1] << 16) + + ((in_addr_t)data[i + 2] << 8) + + data[i + 3]; i += 4; - } else { - warning("Incorrect subnet width: %d", width); + break; + default: + warning("Incorrect subnet width: %u", width); return (0); } + mask = (in_addr_t)(~0) << (32 - width); addr = ntohl(addr); mask = ntohl(mask); @@ -2899,10 +2912,9 @@ check_classless_option(unsigned char *data, int len) data[i - 1] = (unsigned char)( (addr >> (((32 - width)/8)*8)) & 0xFF); } - i += 4; } if (i > len) { - warning("Incorrect data length: %d (must be %d)", len, i); + warning("Incorrect data length: %zu (must be %u)", len, i); return (0); } return (1);