From 32aa9a41e2013e5ee6eee09317a848647e37badf Mon Sep 17 00:00:00 2001 From: Dirk Ziegelmeier Date: Wed, 19 Apr 2017 06:35:07 +0200 Subject: [PATCH] Apply patch from Kudratov Olimjon: Array index used before limits check while ((q != NULL) && (options[offset] != DHCP_OPTION_END) && (offset < offset_max)) { should be while ((q != NULL) && (offset < offset_max) && (options[offset] != DHCP_OPTION_END)) { See https://jira.reactos.org/browse/CORE-8978 for more info. --- src/core/ipv4/dhcp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/core/ipv4/dhcp.c b/src/core/ipv4/dhcp.c index 39df9a92..85f5a4de 100644 --- a/src/core/ipv4/dhcp.c +++ b/src/core/ipv4/dhcp.c @@ -1499,7 +1499,7 @@ again: offset_max = options_idx_max; options = (u8_t*)q->payload; /* at least 1 byte to read and no end marker, then at least 3 bytes to read? */ - while ((q != NULL) && (options[offset] != DHCP_OPTION_END) && (offset < offset_max)) { + while ((q != NULL) && (offset < offset_max) && (options[offset] != DHCP_OPTION_END)) { u8_t op = options[offset]; u8_t len; u8_t decode_len = 0;