denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

dhcp: Fix potential OOB read when parsing DHCP messages

Browse Source 
The missing parentheses around the additions when calculating optlen
in the previous code can cause an out-of-bound read of up to 228 bytes
if no DHCP_OPTEND is found in the message (the calculation basically
evaluated to `- 20 + 8 + 240`).

Since the buffer for the received packet (via pf_handler_t) is located
on the stack, this shouldn't cause much of an issue in practice.
This commit is contained in:
Tobias Brunner
2026-05-19 17:27:33 +02:00
parent 7faf93b701
commit 8f22345542
1 changed files with 5 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libcharon/plugins/dhcp/dhcp_socket.c
+5 -5
View File
@@ -641,14 +641,14 @@ CALLBACK(receive_dhcp, void,
int fd, chunk_t pkt) int fd, chunk_t pkt)
{ {
dhcp_packet_t *packet = (dhcp_packet_t*)pkt.ptr; dhcp_packet_t *packet = (dhcp_packet_t*)pkt.ptr;
size_t optlen, origoptlen, optpos = 0, optsize; size_t optoffset, optlen, origoptlen, optpos = 0, optsize;
dhcp_option_t *option; dhcp_option_t *option;
if (pkt.len >= sizeof(struct ip) + sizeof(struct udphdr) + optoffset = sizeof(struct ip) + sizeof(struct udphdr) +
offsetof(dhcp_t, options)) offsetof(dhcp_t, options);
if (pkt.len >= optoffset)
{ {
origoptlen = optlen = pkt.len - sizeof(struct ip) + origoptlen = optlen = pkt.len - optoffset;
sizeof(struct udphdr) + offsetof(dhcp_t, options);
while (optlen > sizeof(dhcp_option_t)) while (optlen > sizeof(dhcp_option_t))
{ {
option = (dhcp_option_t*)&packet->dhcp.options[optpos]; option = (dhcp_option_t*)&packet->dhcp.options[optpos];