mirror/lwip
1
0
Fork 0
mirror of https://github.com/lwip-tcpip/lwip.git synced 2024-11-16 14:11:02 +00:00
Code Issues Packages Projects Releases Wiki Activity

Apply patch from Kudratov Olimjon: Array index used before limits check

Browse Source 
while ((q != NULL) && (options[offset] != DHCP_OPTION_END) && (offset < offset_max)) {
should be
while ((q != NULL) && (offset < offset_max) && (options[offset] != DHCP_OPTION_END)) {

See https://jira.reactos.org/browse/CORE-8978 for more info.
(cherry picked from commit 32aa9a41e2)
This commit is contained in:
Dirk Ziegelmeier 2017-04-19 06:35:07 +02:00 committed by goldsimon
parent 56a295f0a0
commit dced7dad41
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/core/ipv4/dhcp.c
View File

@ -1500,7 +1500,7 @@ again:
offset_max = options_idx_max;
options = (u8_t*)q->payload;
/* at least 1 byte to read and no end marker, then at least 3 bytes to read? */
while ((q != NULL) && (options[offset] != DHCP_OPTION_END) && (offset < offset_max)) {
while ((q != NULL) && (offset < offset_max) && (options[offset] != DHCP_OPTION_END)) {
u8_t op = options[offset];
u8_t len;
u8_t decode_len = 0;