git-svn-id: http://svn.ipfire.org/svn/ipfire/IPFire/source@16 ea5c0bd1-69bd-2848...

[people/pmueller/ipfire-2.x.git] / src / patches / dhcpcd-1.3.22-pl4_corrupt-packet.patch

Fix for CAN-2005-1848 borrowed from gentoo / debian
--- client.c.orig       2005-07-10 10:16:43.000000000 +0100
+++ client.c    2005-07-10 10:22:31.000000000 +0100
@@ -129,6 +129,8 @@
                default:
          if ( p[1] )
            {
+             if (p + 2 + p[1] >= end)
+                 goto swend; /* Corrupt packet */
              if ( DhcpOptions.len[*p] == p[1] )
                memcpy(DhcpOptions.val[*p],p+2,p[1]);
              else