From: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
Date: Fri, 24 Apr 2020 10:18:26 +0000 (+0100)
Subject: dhcp.c: further improve validation
X-Git-Url: https://git.librecmc.org/?a=commitdiff_plain;h=f4d759be54ceb37714e9a6ca320d5b50c95e9ce9;p=oweals%2Frelayd.git

dhcp.c: further improve validation

Add 2 more length/bounds checks with thanks to
Guido Vranken <guido@guidovranken.com>

Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
---

diff --git a/dhcp.c b/dhcp.c
index 4dbdece..b685086 100644
--- a/dhcp.c
+++ b/dhcp.c
@@ -94,6 +94,8 @@ parse_dhcp_options(struct relayd_host *host, struct dhcp_header *dhcp, int len)
 			break;
 
 		opt = (void *) &opt->data[opt->len];
+		if ((uint8_t *) opt + sizeof(*opt) > end )
+			break;
 		switch(opt->code) {
 		case DHCP_OPTION_ROUTER:
 			DPRINTF(2, "Found a DHCP router option, len=%d\n", opt->len);
@@ -137,7 +139,8 @@ bool relayd_handle_dhcp_packet(struct relayd_interface *rif, void *data, int len
 	udp = (void *) ((char *) &pkt->iph + (pkt->iph.ihl << 2));
 	dhcp = (void *) (udp + 1);
 
-	if ((uint8_t *)udp + sizeof(*udp) > (uint8_t *)data + len )
+	if ((uint8_t *)udp  + sizeof(*udp)  > (uint8_t *)data + len ||
+	    (uint8_t *)dhcp + sizeof(*dhcp) > (uint8_t *)data + len)
 		return false;
 
 	udplen = ntohs(udp->len);