Fix bug #54805: IP address can not be obtained over dhcp if PBUF_POOL_BUFSIZE is too small

Patch by Christoph Chang
This commit is contained in:
Dirk Ziegelmeier 2018-10-19 21:06:15 +02:00 committed by Erik Ekman
parent 214e2d90f3
commit 051fbea5e6

View File

@ -1508,6 +1508,7 @@ dhcp_parse_reply(struct pbuf *p, struct dhcp *dhcp)
u8_t *options; u8_t *options;
u16_t offset; u16_t offset;
u16_t offset_max; u16_t offset_max;
u16_t options_offset;
u16_t options_idx; u16_t options_idx;
u16_t options_idx_max; u16_t options_idx_max;
struct pbuf *q; struct pbuf *q;
@ -1540,6 +1541,7 @@ dhcp_parse_reply(struct pbuf *p, struct dhcp *dhcp)
options_idx_max = p->tot_len; options_idx_max = p->tot_len;
again: again:
q = p; q = p;
options_offset = options_idx;
while ((q != NULL) && (options_idx >= q->len)) { while ((q != NULL) && (options_idx >= q->len)) {
options_idx = (u16_t)(options_idx - q->len); options_idx = (u16_t)(options_idx - q->len);
options_idx_max = (u16_t)(options_idx_max - q->len); options_idx_max = (u16_t)(options_idx_max - q->len);
@ -1613,7 +1615,7 @@ again:
case (DHCP_OPTION_OVERLOAD): case (DHCP_OPTION_OVERLOAD):
LWIP_DHCP_INPUT_ERROR("len == 1", len == 1, return ERR_VAL;); LWIP_DHCP_INPUT_ERROR("len == 1", len == 1, return ERR_VAL;);
/* decode overload only in options, not in file/sname: invalid packet */ /* decode overload only in options, not in file/sname: invalid packet */
LWIP_DHCP_INPUT_ERROR("overload in file/sname", options_idx == DHCP_OPTIONS_OFS, return ERR_VAL;); LWIP_DHCP_INPUT_ERROR("overload in file/sname", options_offset == DHCP_OPTIONS_OFS, return ERR_VAL;);
decode_idx = DHCP_OPTION_IDX_OVERLOAD; decode_idx = DHCP_OPTION_IDX_OVERLOAD;
break; break;
case (DHCP_OPTION_MESSAGE_TYPE): case (DHCP_OPTION_MESSAGE_TYPE):