Correct an unsigned math operation when calculating the options

buffer space for bootp and use a better constant - DHCP packet
size instead of DHCP packet size + udp and iP headers.
Check that we have a packet->options structure before using it.
Only process packets that are longer than a bootp fixed packet
including server and file names.  Previously we allowed for
shorter packets but that wasn't working and nobody noticed.

diff --git a/common/discover.c b/common/discover.c
index 07129e5dcc0cf758f2f4b5a1d2fa66297e488775..1d8421928ea3c2f7bfeada8fff996dae55bc7cc4 100644 (file)
--- a/common/discover.c
+++ b/common/discover.c
@@ -1403,12 +1403,16 @@ isc_result_t got_one (h)
        if (result == 0)
                return ISC_R_UNEXPECTED;
 
-       /* If we didn't at least get the fixed portion of the BOOTP
-          packet, drop the packet.  We're allowing packets with no
-          sname or filename, because we're aware of at least one
-          client that sends such packets, but this definitely falls
-          into the category of being forgiving. */
-       if (result < DHCP_FIXED_NON_UDP - DHCP_SNAME_LEN - DHCP_FILE_LEN)
+       /*
+        * If we didn't at least get the fixed portion of the BOOTP
+        * packet, drop the packet.
+        * Previously we allowed packets with no sname or filename
+        * as we were aware of at least one client that did.  But
+        * a bug caused short packets to not work and nobody has
+        * complained, it seems rational to tighten up that
+        * restriction.
+        */
+       if (result < DHCP_FIXED_NON_UDP)
                return ISC_R_UNEXPECTED;
 
 #if defined(IP_PKTINFO) && defined(IP_RECVPKTINFO) && defined(USE_V4_PKTINFO)

diff --git a/common/options.c b/common/options.c
index 09c4cd02931aed07f3fa6c370a18aec51b344420..2be93384128c2f7519f841f969d680284e442648 100644 (file)
--- a/common/options.c
+++ b/common/options.c
@@ -592,8 +592,8 @@ cons_options(struct packet *inpacket, struct dhcp_packet *outpacket,
        } else if (bootpp) {
                mb_size = 64;
                if (inpacket != NULL &&
-                   (inpacket->packet_length - DHCP_FIXED_LEN >= 64))
-                       mb_size = inpacket->packet_length - DHCP_FIXED_LEN;
+                   (inpacket->packet_length >= 64 + DHCP_FIXED_NON_UDP))
+                       mb_size = inpacket->packet_length - DHCP_FIXED_NON_UDP;
        } else
                mb_size = DHCP_MIN_OPTION_LEN;
 

diff --git a/server/dhcp.c b/server/dhcp.c
index de27c1a935a39fa81736fb7a828c99c8edc68005..3650b5558a7f87c76e39e774231983aab92104ac 100644 (file)
--- a/server/dhcp.c
+++ b/server/dhcp.c
@@ -2354,6 +2354,7 @@ void ack_lease (packet, lease, offer, when, msg, ms_nulltp, hp)
         * giaddr.
         */
        if (!packet->agent_options_stashed &&
+           (packet->otpions != NULL) &&
            packet->options->universe_count > agent_universe.index &&
            packet->options->universes[agent_universe.index] != NULL) {
            oc = lookup_option (&server_universe, state -> options,
@@ -4506,6 +4507,7 @@ maybe_return_agent_options(struct packet *packet, struct option_state *options)
         * by the user into the new state, not just give up.
         */
        if (!packet->agent_options_stashed &&
+           (packet->otpions != NULL) &&
            packet->options->universe_count > agent_universe.index &&
            packet->options->universes[agent_universe.index] != NULL &&
            (options->universe_count <= agent_universe.index ||