mirror of
https://github.com/lwip-tcpip/lwip.git
synced 2024-09-28 23:00:50 +00:00
Apply patch from Kudratov Olimjon: Array index used before limits check
while ((q != NULL) && (options[offset] != DHCP_OPTION_END) && (offset < offset_max)) {
should be
while ((q != NULL) && (offset < offset_max) && (options[offset] != DHCP_OPTION_END)) {
See https://jira.reactos.org/browse/CORE-8978 for more info.
(cherry picked from commit 32aa9a41e2
)
This commit is contained in:
parent
56a295f0a0
commit
dced7dad41
@ -1500,7 +1500,7 @@ again:
|
|||||||
offset_max = options_idx_max;
|
offset_max = options_idx_max;
|
||||||
options = (u8_t*)q->payload;
|
options = (u8_t*)q->payload;
|
||||||
/* at least 1 byte to read and no end marker, then at least 3 bytes to read? */
|
/* at least 1 byte to read and no end marker, then at least 3 bytes to read? */
|
||||||
while ((q != NULL) && (options[offset] != DHCP_OPTION_END) && (offset < offset_max)) {
|
while ((q != NULL) && (offset < offset_max) && (options[offset] != DHCP_OPTION_END)) {
|
||||||
u8_t op = options[offset];
|
u8_t op = options[offset];
|
||||||
u8_t len;
|
u8_t len;
|
||||||
u8_t decode_len = 0;
|
u8_t decode_len = 0;
|
||||||
|
Loading…
Reference in New Issue
Block a user