bootp: limit vendor-specific area to input packet memory buffer

sizeof(bootp_t) currently holds DHCP_OPT_LEN. Remove this optional field
from the structure, to help with the following patch checking for
minimal header size. Modify the bootp_reply() function to take the
buffer boundaries and avoiding potential buffer overflow.

Related to CVE-2021-3592.

https://gitlab.freedesktop.org/slirp/libslirp/-/issues/44

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>

1 files changed, 5 insertions, 0 deletions

diff --git a/src/mbuf.c b/src/mbuf.c
index b4152c3..36864a4 100644
--- a/src/mbuf.c
+++ b/src/mbuf.c
@@ -274,3 +274,8 @@ void *mtod_check(struct mbuf *m, size_t len)
 
     return NULL;
 }
+
+void *m_end(struct mbuf *m)
+{
+    return m->m_data + m->m_len;
+}