From: Jouni Malinen <jouni@qca.qualcomm.com>
Date: Tue, 31 Jan 2017 12:43:56 +0000 (+0200)
Subject: ProxyARP: Use more robust DHCP option parsing
X-Git-Tag: hostap_2_7~1694
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=5a9d5049381a1bcebd527838362ff4d37de6758e;p=thirdparty%2Fhostap.git

ProxyARP: Use more robust DHCP option parsing

Do not depend on undefined behavior with pointer arithmetic when
checking whether there is sufficient room for an option.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
---

diff --git a/src/ap/dhcp_snoop.c b/src/ap/dhcp_snoop.c
index 1b356a2b8..b9a36d760 100644
--- a/src/ap/dhcp_snoop.c
+++ b/src/ap/dhcp_snoop.c
@@ -62,6 +62,8 @@ static void handle_dhcp(void *ctx, const u8 *src_addr, const u8 *buf,
 		if (*opt == DHCP_OPT_PAD)
 			continue;
 
+		if (pos >= end || 1 + *pos > end - pos)
+			break;
 		pos += *pos + 1;
 		if (pos >= end)
 			break;