From: Denys Vlasenko Date: Tue, 25 Oct 2016 12:25:52 +0000 (+0200) Subject: udhcpc: check read of overload option data byte to be within packet X-Git-Tag: 1_26_0~139 X-Git-Url: https://git.librecmc.org/?a=commitdiff_plain;h=f11c6989ba40f6bed8c4b4f0b6b7578aba3a63f9;p=oweals%2Fbusybox.git udhcpc: check read of overload option data byte to be within packet function old new delta udhcp_get_option 220 225 +5 Signed-off-by: Denys Vlasenko --- diff --git a/networking/udhcp/common.c b/networking/udhcp/common.c index 589bcd674..1aaf5255c 100644 --- a/networking/udhcp/common.c +++ b/networking/udhcp/common.c @@ -268,7 +268,8 @@ uint8_t* FAST_FUNC udhcp_get_option(struct dhcp_packet *packet, int code) } if (optionptr[OPT_CODE] == DHCP_OPTION_OVERLOAD) { - overload |= optionptr[OPT_DATA]; + if (len >= 3) + overload |= optionptr[OPT_DATA]; /* fall through */ } optionptr += len;