From 8f223455424e68a7b21adfa20f5324968c89ee25 Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Mon, 11 May 2026 10:40:36 +0200 Subject: [PATCH] dhcp: Fix potential OOB read when parsing DHCP messages The missing parentheses around the additions when calculating optlen in the previous code can cause an out-of-bound read of up to 228 bytes if no DHCP_OPTEND is found in the message (the calculation basically evaluated to `- 20 + 8 + 240`). Since the buffer for the received packet (via pf_handler_t) is located on the stack, this shouldn't cause much of an issue in practice. --- src/libcharon/plugins/dhcp/dhcp_socket.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/src/libcharon/plugins/dhcp/dhcp_socket.c b/src/libcharon/plugins/dhcp/dhcp_socket.c index 2474a0b10..f7e7ba1e1 100644 --- a/src/libcharon/plugins/dhcp/dhcp_socket.c +++ b/src/libcharon/plugins/dhcp/dhcp_socket.c @@ -641,14 +641,14 @@ CALLBACK(receive_dhcp, void, int fd, chunk_t pkt) { dhcp_packet_t *packet = (dhcp_packet_t*)pkt.ptr; - size_t optlen, origoptlen, optpos = 0, optsize; + size_t optoffset, optlen, origoptlen, optpos = 0, optsize; dhcp_option_t *option; - if (pkt.len >= sizeof(struct ip) + sizeof(struct udphdr) + - offsetof(dhcp_t, options)) + optoffset = sizeof(struct ip) + sizeof(struct udphdr) + + offsetof(dhcp_t, options); + if (pkt.len >= optoffset) { - origoptlen = optlen = pkt.len - sizeof(struct ip) + - sizeof(struct udphdr) + offsetof(dhcp_t, options); + origoptlen = optlen = pkt.len - optoffset; while (optlen > sizeof(dhcp_option_t)) { option = (dhcp_option_t*)&packet->dhcp.options[optpos];