udhcpc: check read of overload option data byte to be within packet

function                                             old     new   delta
udhcp_get_option                                     220     225      +5

Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>

diff --git a/networking/udhcp/common.c b/networking/udhcp/common.c
index 589bcd674986cb84aae26fbb112c18168b21be12..1aaf5255c80484bc1103be9732c7e592ea589726 100644 (file)
--- a/networking/udhcp/common.c
+++ b/networking/udhcp/common.c
@@ -268,7 +268,8 @@ uint8_t* FAST_FUNC udhcp_get_option(struct dhcp_packet *packet, int code)
                }
 
                if (optionptr[OPT_CODE] == DHCP_OPTION_OVERLOAD) {
-                       overload |= optionptr[OPT_DATA];
+                       if (len >= 3)
+                               overload |= optionptr[OPT_DATA];
                        /* fall through */
                }
                optionptr += len;