dhcp: be more careful when parsing strings from DHCP packets

Let's make sure there's no embedded 0 byte. Also, let's reset the string
if the length is zero.

diff --git a/src/libsystemd-network/sd-dhcp-lease.c b/src/libsystemd-network/sd-dhcp-lease.c
index f5b9e225899473181d594461a6aa8806b5c3794a..57369a353de8803e259814c874a292210f1fffc6 100644 (file)
--- a/src/libsystemd-network/sd-dhcp-lease.c
+++ b/src/libsystemd-network/sd-dhcp-lease.c
@@ -287,13 +287,17 @@ static int lease_parse_string(const uint8_t *option, size_t len, char **ret) {
         if (len >= 1) {
                 char *string;
 
+                if (memchr(option, 0, len))
+                        return -EINVAL;
+
                 string = strndup((const char *)option, len);
                 if (!string)
-                        return -errno;
+                        return -ENOMEM;
 
                 free(*ret);
                 *ret = string;
-        }
+        } else
+                *ret = mfree(*ret);
 
         return 0;
 }