Apply patch from Kudratov Olimjon: Array index used before limits check

while ((q != NULL) && (options[offset] != DHCP_OPTION_END) && (offset < offset_max)) {
should be
while ((q != NULL) && (offset < offset_max) && (options[offset] != DHCP_OPTION_END)) {

See https://jira.reactos.org/browse/CORE-8978 for more info.
(cherry picked from commit 32aa9a41e2)
This commit is contained in:
Dirk Ziegelmeier 2017-04-19 06:35:07 +02:00 committed by goldsimon
parent 56a295f0a0
commit dced7dad41

View File

@ -1500,7 +1500,7 @@ again:
offset_max = options_idx_max;
options = (u8_t*)q->payload;
/* at least 1 byte to read and no end marker, then at least 3 bytes to read? */
while ((q != NULL) && (options[offset] != DHCP_OPTION_END) && (offset < offset_max)) {
while ((q != NULL) && (offset < offset_max) && (options[offset] != DHCP_OPTION_END)) {
u8_t op = options[offset];
u8_t len;
u8_t decode_len = 0;