diff options
| author | Sean Edmond <seanedmond@microsoft.com> | 2023-07-25 16:13:29 -0700 |
|---|---|---|
| committer | Tom Rini <trini@konsulko.com> | 2023-11-05 13:28:40 -0500 |
| commit | b2369a19b8249ae45e501dc453a099f2a20a320f (patch) | |
| tree | 452334a24895d2eddcbf984a2f73f7b616d14486 | |
| parent | 5d260d08009e9bf4b4aec0e414e68ab30e784602 (diff) | |
| download | u-boot-b2369a19b8249ae45e501dc453a099f2a20a320f.zip u-boot-b2369a19b8249ae45e501dc453a099f2a20a320f.tar.gz u-boot-b2369a19b8249ae45e501dc453a099f2a20a320f.tar.bz2 | |
net: dhcp6: Fix OPT_BOOTFILE_PARAM parsing
RFC 5970 states that OPT_BOOTFILE_PARAM (option 60) can be
multiple parameters that start with a 16-bit length field followed
by the parameter. For example:
[ param-len 1 (16-bits) ] [ parameter 1 (variable length) ]
This fix ensure we're considering "param-len 1" in the parsing.
Signed-off-by: Sean Edmond <seanedmond@microsoft.com>
| -rw-r--r-- | net/dhcpv6.c | 15 |
1 files changed, 12 insertions, 3 deletions
diff --git a/net/dhcpv6.c b/net/dhcpv6.c index 73a1067..4aea779 100644 --- a/net/dhcpv6.c +++ b/net/dhcpv6.c @@ -304,7 +304,7 @@ static void dhcp6_parse_ia_options(struct dhcp6_option_hdr *ia_ptr, uchar *ia_op static void dhcp6_parse_options(uchar *rx_pkt, unsigned int len) { uchar *option_ptr; - int sol_max_rt_sec, option_len; + int sol_max_rt_sec, option_len, param_len_1; char *s, *e; struct dhcp6_option_hdr *option_hdr; @@ -390,14 +390,23 @@ static void dhcp6_parse_options(uchar *rx_pkt, unsigned int len) case DHCP6_OPTION_OPT_BOOTFILE_PARAM: if (IS_ENABLED(CONFIG_DHCP6_PXE_DHCP_OPTION)) { debug("DHCP6_OPTION_OPT_BOOTFILE_PARAM FOUND\n"); + /* if CONFIG_DHCP6_PXE_DHCP_OPTION is set the PXE config file path + * is contained in the first OPT_BOOTFILE_PARAM argument + */ + param_len_1 = ntohs(*((u16 *)option_ptr)); + option_ptr += sizeof(u16); + if (param_len_1 + sizeof(u16) > option_len) { + debug("Invalid BOOTFILE_PARAM param_len_1. Skipping\n"); + break; + } if (pxelinux_configfile) free(pxelinux_configfile); - pxelinux_configfile = (char *)malloc((option_len + 1) * + pxelinux_configfile = (char *)malloc((param_len_1 + 1) * sizeof(char)); if (pxelinux_configfile) - strlcpy(pxelinux_configfile, option_ptr, option_len + 1); + strlcpy(pxelinux_configfile, option_ptr, param_len_1 + 1); else printf("Error: Failed to allocate pxelinux_configfile\n"); |