dect
/
linux-2.6
Archived
13
0
Fork 0
Code Releases Activity

batman-adv: fix wrong dhcp option list browsing 

In is_type_dhcprequest(), while parsing a DHCP message, if the entry we found in
the option list is neither a padding nor the dhcp-type, we have to ignore it and
jump as many bytes as its length + 1. The "+ 1" byte is given by the subtype
field itself that has to be jumped too.

Reported-by: Marek Lindner <lindner_marek@yahoo.de>
Signed-off-by: Antonio Quartulli <ordex@autistici.org>
This commit is contained in:
Antonio Quartulli 2012-02-27 11:29:53 +01:00
parent 06a4c1c55d
commit 9205cc521e
1 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
net/batman-adv/gateway_client.c
View File

@ -558,10 +558,10 @@ static bool is_type_dhcprequest(struct sk_buff *skb, int header_len)
p++;
/* ...and then we jump over the data */
if (pkt_len < *p)
if (pkt_len < 1 + (*p))
goto out;
pkt_len -= *p;
p += (*p);
pkt_len -= 1 + (*p);
p += 1 + (*p);
}
}
out: