From: Lennart Poettering <lennart@poettering.net>
Date: Mon, 30 May 2016 16:28:51 +0000 (+0200)
Subject: dhcp-server: fix integer underflow
X-Git-Tag: v231~220^2~2
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=76a9d0f1713a39471ea6c85e982fb0b447ef1315;p=thirdparty%2Fsystemd.git

dhcp-server: fix integer underflow

Let's better ignore an invalid message size parameter, than assume ridiculously
larger sizes.
---

diff --git a/src/libsystemd-network/sd-dhcp-server.c b/src/libsystemd-network/sd-dhcp-server.c
index a1af5da40ff..ea4f03df1d5 100644
--- a/src/libsystemd-network/sd-dhcp-server.c
+++ b/src/libsystemd-network/sd-dhcp-server.c
@@ -633,7 +633,8 @@ static int parse_request(uint8_t code, uint8_t len, const void *option, void *us
 
                 break;
         case SD_DHCP_OPTION_MAXIMUM_MESSAGE_SIZE:
-                if (len == 2)
+
+                if (len == 2 && unaligned_read_be16(option) >= sizeof(DHCPPacket))
                         req->max_optlen = unaligned_read_be16(option) - sizeof(DHCPPacket);
 
                 break;