mirror/lwip
1
0
Fork 0
mirror of https://github.com/lwip-tcpip/lwip.git synced 2024-07-07 13:29:19 +00:00
Code Issues Packages Projects Releases Wiki Activity

Apply patch from Kudratov Olimjon: Array index used before limits check

Browse Source 
while ((q != NULL) && (options[offset] != DHCP_OPTION_END) && (offset < offset_max)) {
should be
while ((q != NULL) && (offset < offset_max) && (options[offset] != DHCP_OPTION_END)) {

See https://jira.reactos.org/browse/CORE-8978 for more info.
This commit is contained in:
Dirk Ziegelmeier 2017-04-19 06:35:07 +02:00
parent 8e83e206f4
commit 32aa9a41e2
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/core/ipv4/dhcp.c
View File

@ -1499,7 +1499,7 @@ again:
offset_max = options_idx_max;
options = (u8_t*)q->payload;
/* at least 1 byte to read and no end marker, then at least 3 bytes to read? */
while ((q != NULL) && (options[offset] != DHCP_OPTION_END) && (offset < offset_max)) {
while ((q != NULL) && (offset < offset_max) && (options[offset] != DHCP_OPTION_END)) {
u8_t op = options[offset];
u8_t len;
u8_t decode_len = 0;