From: Alan T. DeKok <aland@freeradius.org>
Date: Thu, 31 Oct 2019 14:06:08 +0000 (-0400)
Subject: check length
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=da66e3bf0bc080ee0bd54672d37ef4ee0aed7c3e;p=thirdparty%2Ffreeradius-server.git

check length
---

diff --git a/src/protocols/dhcpv4/decode.c b/src/protocols/dhcpv4/decode.c
index e1d1db33c58..ab365f60e7a 100644
--- a/src/protocols/dhcpv4/decode.c
+++ b/src/protocols/dhcpv4/decode.c
@@ -268,8 +268,9 @@ static ssize_t decode_tlv(TALLOC_CTX *ctx, fr_cursor_t *cursor, fr_dict_attr_t c
 		}
 
 		if ((p[1] + 2) > (end - p)) {
-			fr_strerror_printf("%s: Suboption would overflow option.  Remaining option data %zu byte(s) "
-					   "(from %zu), Suboption length %u", __FUNCTION__, (end - p), data_len, p[1]);
+			fr_strerror_printf("%s: Suboption %02x would overflow option.  Remaining option data %zu byte(s) "
+					   "(from %zu), Suboption length %u",
+					   __FUNCTION__, p[0], (end - p), data_len, p[1]);
 			return -1;
 		}
 
diff --git a/src/protocols/dhcpv4/packet.c b/src/protocols/dhcpv4/packet.c
index ae2e116021e..b7d8fe6b355 100644
--- a/src/protocols/dhcpv4/packet.c
+++ b/src/protocols/dhcpv4/packet.c
@@ -286,7 +286,7 @@ int fr_dhcpv4_packet_decode(RADIUS_PACKET *packet)
 			 *	Vendor is "MSFT 98"
 			 */
 			vp = fr_pair_find_by_da(head, attr_dhcp_vendor_class_identifier, TAG_ANY);
-			if (vp && (strcmp(vp->vp_strvalue, "MSFT 98") == 0)) {
+			if (vp && (vp->vp_length == 7) && (memcmp(vp->vp_strvalue, "MSFT 98", 7) == 0)) {
 				vp = fr_pair_find_by_da(head, attr_dhcp_flags, TAG_ANY);
 
 				/*