ProxyARP: Use more robust DHCP option parsing

Do not depend on undefined behavior with pointer arithmetic when
checking whether there is sufficient room for an option.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>

diff --git a/src/ap/dhcp_snoop.c b/src/ap/dhcp_snoop.c
index 1b356a2b8802cea2993c821036ae64175937ce95..b9a36d760fd013340800f9c49ee0c3a029d8bb92 100644 (file)
--- a/src/ap/dhcp_snoop.c
+++ b/src/ap/dhcp_snoop.c
@@ -62,6 +62,8 @@ static void handle_dhcp(void *ctx, const u8 *src_addr, const u8 *buf,
                if (*opt == DHCP_OPT_PAD)
                        continue;
 
+               if (pos >= end || 1 + *pos > end - pos)
+                       break;
                pos += *pos + 1;
                if (pos >= end)
                        break;