net: Fix parsing of Bootp/DHCP option 0 (Pad)
authorStefan Brüns <stefan.bruens@rwth-aachen.de>
Fri, 28 Aug 2015 08:15:54 +0000 (10:15 +0200)
committerJoe Hershberger <joe.hershberger@ni.com>
Wed, 28 Oct 2015 19:56:20 +0000 (14:56 -0500)
Pad has no len byte, so the normal parsing code fails.

Signed-off-by: Stefan Brüns <stefan.bruens@rwth-aachen.de>
Acked-by: Joe Hershberger <joe.hershberger@ni.com>
net/bootp.c

index 93eff872468418a436343c2e6b40578ef1350527..1316f00dd8462e5317c1f21499ad489320d277d5 100644 (file)
@@ -776,6 +776,9 @@ static void dhcp_process_options(uchar *popt, struct bootp_hdr *bp)
        while (popt < end && *popt != 0xff) {
                oplen = *(popt + 1);
                switch (*popt) {
+               case 0:
+                       oplen = -1; /* Pad omits len byte */
+                       break;
                case 1:
                        net_copy_ip(&net_netmask, (popt + 2));
                        break;
@@ -879,7 +882,13 @@ static int dhcp_message_type(unsigned char *popt)
        while (*popt != 0xff) {
                if (*popt == 53)        /* DHCP Message Type */
                        return *(popt + 2);
-               popt += *(popt + 1) + 2;        /* Scan through all options */
+               if (*popt == 0) {
+                       /* Pad */
+                       popt += 1;
+               } else {
+                       /* Scan through all options */
+                       popt += *(popt + 1) + 2;
+               }
        }
        return -1;
 }