From: Denys Vlasenko <vda.linux@googlemail.com>
Date: Tue, 14 Jan 2020 16:05:48 +0000 (+0100)
Subject: udhcpd: mangle hostnames starting with dash ("-option")
X-Git-Tag: 1_32_0~94
X-Git-Url: https://git.librecmc.org/?a=commitdiff_plain;h=020abc8856f94d6e355f4daa972ac75fb05ae113;p=oweals%2Fbusybox.git

udhcpd: mangle hostnames starting with dash ("-option")

function                                             old     new   delta
add_lease                                            316     328     +12

Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
---

diff --git a/networking/udhcp/dhcpd.c b/networking/udhcp/dhcpd.c
index 3e08ec011..9d6604943 100644
--- a/networking/udhcp/dhcpd.c
+++ b/networking/udhcp/dhcpd.c
@@ -192,6 +192,8 @@ static struct dyn_lease *add_lease(
 			 * but merely make dumpleases output safe for shells to use.
 			 * We accept "0-9A-Za-z._-", all other chars turn to dots.
 			 */
+			if (*p == '-')
+				*p = '.'; /* defeat "-option" attacks too */
 			while (*p) {
 				if (!isalnum(*p) && *p != '-' && *p != '_')
 					*p = '.';