DHCP: Ensure we have a lease to extract options from.

diff --git a/src/dhcp.c b/src/dhcp.c
index 635e524770f910cbe3b1da61fe2b1e36badd7655..04bddc209efcdf0bbbf34c7b9337798d87e10bb9 100644 (file)
--- a/src/dhcp.c
+++ b/src/dhcp.c
@@ -177,6 +177,11 @@ get_option(struct dhcpcd_ctx *ctx,
        const uint8_t *op;
        size_t bl;
 
+       if (bootp == NULL || bootp_len < DHCP_MIN_LEN) {
+               errno = EINVAL;
+               return NULL;
+       }
+
        /* Check we have the magic cookie */
        if (!IS_DHCP(bootp)) {
                errno = ENOTSUP;
@@ -1180,7 +1185,7 @@ read_lease(struct interface *ifp, struct bootp **bootp)
         * (it should be more, and our read packet enforces this so this
         * code should not be needed, but of course people could
         * scribble whatever in the stored lease file. */
-       if (bytes < offsetof(struct bootp, vend) + 4) {
+       if (bytes < DHCP_MIN_LEN) {
                free(lease);
                logerrx("%s: %s: truncated lease", ifp->name, __func__);
                return 0;

diff --git a/src/dhcp.h b/src/dhcp.h
index 62fa94bbeb13bed318c91807cad746907fa6f68a..d895e341f62549a4d2965ccfa0a715914cff2fde 100644 (file)
--- a/src/dhcp.h
+++ b/src/dhcp.h
@@ -164,6 +164,8 @@ struct bootp {
        /* DHCP allows a variable length vendor area */
 };
 
+#define        DHCP_MIN_LEN            (offsetof(struct bootp, vend) + 4)
+
 struct bootp_pkt
 {
        struct ip ip;