From: Roy Marples <roy@marples.name>
Date: Fri, 30 Jan 2009 20:19:12 +0000 (+0000)
Subject: We should zero the entire message struct so any options don't overflow into unallocat... 
X-Git-Tag: v4.0.9^0
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=60d7bfcd40ad8a9614a2dc4259a4855995b4e5f1;p=thirdparty%2Fdhcpcd.git

We should zero the entire message struct so any options don't overflow into unallocated memory when evaluating them.
---

diff --git a/client.c b/client.c
index 757f236a..0d242e87 100644
--- a/client.c
+++ b/client.c
@@ -1531,7 +1531,6 @@ handle_dhcp_packet(struct if_state *state, const struct options *options)
 	struct interface *iface = state->interface;
 	struct dhcp_message *dhcp = NULL;
 	const uint8_t *pp;
-	uint8_t *p;
 	ssize_t bytes;
 	int retval = -1;
 
@@ -1556,7 +1555,7 @@ handle_dhcp_packet(struct if_state *state, const struct options *options)
 			continue;
 		}
 		if (!dhcp)
-			dhcp = xmalloc(sizeof(*dhcp));
+			dhcp = xzalloc(sizeof(*dhcp));
 		memcpy(dhcp, pp, bytes);
 		if (dhcp->cookie != htonl(MAGIC_COOKIE)) {
 			logger(LOG_DEBUG, "bogus cookie, ignoring");
@@ -1579,13 +1578,6 @@ handle_dhcp_packet(struct if_state *state, const struct options *options)
 			       hwaddr_ntoa(dhcp->chaddr, sizeof(dhcp->chaddr)));
 			continue;
 		}
-		/* We should ensure that the packet is terminated correctly
-		 * if we have space for the terminator */
-		if ((size_t)bytes != sizeof(*dhcp)) {
-			p = (uint8_t *)dhcp + (bytes - 1);
-			if (*p != DHO_END)
-				*++p = DHO_END;
-		}
 		retval = handle_dhcp(state, &dhcp, options);
 		if (retval == 0 && state->options & DHCPCD_TEST)
 			state->options |= DHCPCD_FORKED;