From dced7dad4153e4c5368738eb57d03131366dac94 Mon Sep 17 00:00:00 2001 From: Dirk Ziegelmeier Date: Wed, 19 Apr 2017 06:35:07 +0200 Subject: [PATCH] Apply patch from Kudratov Olimjon: Array index used before limits check while ((q != NULL) && (options[offset] != DHCP_OPTION_END) && (offset < offset_max)) { should be while ((q != NULL) && (offset < offset_max) && (options[offset] != DHCP_OPTION_END)) { See https://jira.reactos.org/browse/CORE-8978 for more info. (cherry picked from commit 32aa9a41e2013e5ee6eee09317a848647e37badf) --- src/core/ipv4/dhcp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/core/ipv4/dhcp.c b/src/core/ipv4/dhcp.c index f7f80f9a..334577a9 100644 --- a/src/core/ipv4/dhcp.c +++ b/src/core/ipv4/dhcp.c @@ -1500,7 +1500,7 @@ again: offset_max = options_idx_max; options = (u8_t*)q->payload; /* at least 1 byte to read and no end marker, then at least 3 bytes to read? */ - while ((q != NULL) && (options[offset] != DHCP_OPTION_END) && (offset < offset_max)) { + while ((q != NULL) && (offset < offset_max) && (options[offset] != DHCP_OPTION_END)) { u8_t op = options[offset]; u8_t len; u8_t decode_len = 0;