Segfault in dhcp_parse_reply if no end marker

If no endmarker is present in a dhcp reply a null pointer is potentially
dereferenced.

Add fix and test case as proof of concept.
This commit is contained in:
Henrik Persson 2012-08-30 13:57:33 +02:00 committed by goldsimon
parent 6b3179fbbf
commit 5e224aba6d

View File

@ -1471,8 +1471,14 @@ decode_next:
if (offset >= q->len) {
offset -= q->len;
offset_max -= q->len;
q = q->next;
options = (u8_t*)q->payload;
if (offset < offset_max && offset_max) {
q = q->next;
LWIP_ASSERT("next pbuf was null", q);
options = (u8_t*)q->payload;
} else {
// We've run out of bytes, probably no end marker. Don't proceed.
break;
}
}
}
/* is this an overloaded message? */