hyung-hwan/qse
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

fixed a boundary check bug in qse_dhcp6_find_option()

Browse Source
This commit is contained in:
hyung-hwan 2022-07-26 07:37:29 +00:00
parent 00b645ef9a
commit 1bac167e2d
1 changed files with 4 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
qse/lib/dhcp/dhcp6msg.c
View File

@ -4,7 +4,7 @@
qse_dhcp6_opt_hdr_t* qse_dhcp6_find_option (const qse_dhcp6_pktinf_t* pkt, int code) qse_dhcp6_opt_hdr_t* qse_dhcp6_find_option (const qse_dhcp6_pktinf_t* pkt, int code)
{ {
qse_dhcp6_opt_hdr_t* opt; qse_dhcp6_opt_hdr_t* opt;
qse_size_t rem; qse_size_t rem, opt_len;
if (pkt->len < QSE_SIZEOF(qse_dhcp6_pkt_hdr_t)) return QSE_NULL; if (pkt->len < QSE_SIZEOF(qse_dhcp6_pkt_hdr_t)) return QSE_NULL;
@ -29,7 +29,9 @@ qse_dhcp6_opt_hdr_t* qse_dhcp6_find_option (const qse_dhcp6_pktinf_t* pkt, int c
return opt; return opt;
} }
rem -= QSE_SIZEOF(qse_dhcp6_opt_hdr_t) + qse_ntoh16(opt->len); opt_len = QSE_SIZEOF(qse_dhcp6_opt_hdr_t) + qse_ntoh16(opt->len);
if (rem < opt_len) break;
rem -= opt_len;
opt = (qse_dhcp6_opt_hdr_t*)((qse_uint8_t*)(opt + 1) + qse_ntoh16(opt->len)); opt = (qse_dhcp6_opt_hdr_t*)((qse_uint8_t*)(opt + 1) + qse_ntoh16(opt->len));
} }