sergiotarxz/nuttx-apps
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

dhcpd: Prevent buffer overflow in dhcpd_addoption. offset represents distance from start of option buffer. So this should be changed current option pointer minus start of buffer.

Browse Source
This commit is contained in:
EunBong Song 2017-08-25 06:50:37 -06:00 committed by Gregory Nutt
parent 7fa2bd1a23
commit d0f74f5346
2 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
ChangeLog.txt
View File

@ -2053,7 +2053,7 @@
array. This cause buffer overflow for part array. This change fixes
this problem. From EunBong Song (2017-05-17).
* apps/examples/can: Fix can example app to print data when
CONFIG_EXAMPLE_CAN_READ is defined. From Alan Carvalho de Assis
CONFIG_EXAMPLES_CAN_READ is defined. From Alan Carvalho de Assis
(2017-05-17).
* apps/: Make more globals static to avoid name clashes. From Juha
Niskanen (2017-05-19).

4
netutils/dhcpd/dhcpd.c
View File

@ -1,7 +1,7 @@
/****************************************************************************
* netutils/dhcpd/dhcpd.c
*
* Copyright (C) 2007-2009, 2011-2014 Gregory Nutt. All rights reserved.
* Copyright (C) 2007-2009, 2011-2014, 2017 Gregory Nutt. All rights reserved.
* Author: Gregory Nutt <gnutt@nuttx.org>
*
* Redistribution and use in source and binary forms, with or without
@ -705,7 +705,7 @@ static int dhcpd_addoption(uint8_t *option)
if (g_state.ds_optend)
{
offset = g_state.ds_outpacket.options - g_state.ds_optend;
offset = g_state.ds_optend - g_state.ds_outpacket.options;
len = option[DHCPD_OPTION_LENGTH] + 2;
/* Check if the option will fit into the options array */