diff options
| author | Sean Edmond <seanedmond@microsoft.com> | 2023-05-18 12:35:40 -0700 |
|---|---|---|
| committer | Tom Rini <trini@konsulko.com> | 2023-06-14 15:48:45 -0400 |
| commit | 1b3117db3ecdb0ec281899a00c8662b22059c01b (patch) | |
| tree | 12d5705a179a1bf74ca78d0a31847332660c33f3 /net/dhcpv6.c | |
| parent | 70ca9f62f3ac3cb67be696815e8be8600623795f (diff) | |
| download | u-boot-1b3117db3ecdb0ec281899a00c8662b22059c01b.tar.gz u-boot-1b3117db3ecdb0ec281899a00c8662b22059c01b.tar.bz2 u-boot-1b3117db3ecdb0ec281899a00c8662b22059c01b.zip | |
net: ipv6: Fix CID 453851 and CID 436278
CID 453851 : sprintf() shouldn't copy from/to tmp
CID 436278 : DHCP6 option_len should be checked before use
Signed-off-by: Sean Edmond <seanedmond@microsoft.com>
Reviewed-by: Ramon Fried <rfried.dev@gmail.com>
Diffstat (limited to 'net/dhcpv6.c')
| -rw-r--r-- | net/dhcpv6.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/net/dhcpv6.c b/net/dhcpv6.c index 0d1c600632..73a1067877 100644 --- a/net/dhcpv6.c +++ b/net/dhcpv6.c @@ -316,6 +316,11 @@ static void dhcp6_parse_options(uchar *rx_pkt, unsigned int len) option_ptr = ((uchar *)option_hdr) + sizeof(struct dhcp6_hdr); option_len = ntohs(option_hdr->option_len); + if (option_ptr + option_len > rx_pkt + len) { + debug("Invalid option length\n"); + return; + } + switch (ntohs(option_hdr->option_id)) { case DHCP6_OPTION_CLIENTID: if (memcmp(option_ptr, sm_params.duid, option_len) |