From 1eeb70fbfab284054da4a3bc96d366eac77c4c2a Mon Sep 17 00:00:00 2001
From: Simon Goldschmidt <goldsimon@gmx.de>
Date: Thu, 12 Oct 2023 22:08:14 +0200
Subject: [PATCH] dhcp: fix memory corruption when LWIP_DHCP_MAX_DNS_SERVERS  >
 DNS_MAX_SERVERS

see patch #10124
---
 src/core/ipv4/dhcp.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/core/ipv4/dhcp.c b/src/core/ipv4/dhcp.c
index d9ed8b0f..12e00683 100644
--- a/src/core/ipv4/dhcp.c
+++ b/src/core/ipv4/dhcp.c
@@ -1600,7 +1600,7 @@ again:
         /* special case: there might be more than one server */
         LWIP_DHCP_INPUT_ERROR("len %% 4 == 0", len % 4 == 0, return ERR_VAL;);
         /* limit number of DNS servers */
-        decode_len = LWIP_MIN(len, 4 * DNS_MAX_SERVERS);
+        decode_len = LWIP_MIN(len, 4 * LWIP_DHCP_PROVIDE_DNS_SERVERS);
         LWIP_DHCP_INPUT_ERROR("len >= decode_len", len >= decode_len, return ERR_VAL;);
         decode_idx = DHCP_OPTION_IDX_DNS_SERVER;
         break;