From: Shawn Routhier <sar@isc.org>
Date: Wed, 29 Dec 2010 22:56:01 +0000 (+0000)
Subject: When processing the format flags for a given option consume the
X-Git-Tag: v4_3_0a1~223
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=e1a402115d2522187ef1706b4735cc00de5c3b28;p=thirdparty%2Fdhcp.git

When processing the format flags for a given option consume the
flag indicating an optional value correctly.  A symptom of this
bug was an infinite loop when trying to parse the slp-service-scope
option.  Thanks to a patch from Marius Tomaschewski.
[ISC-Bugs #22055]
---

diff --git a/RELNOTES b/RELNOTES
index f7edada2b..4b8c55c92 100644
--- a/RELNOTES
+++ b/RELNOTES
@@ -169,6 +169,12 @@ work on other platforms. Please report any problems and suggested fixes to
   Thanks to a report from Jiri Popelka at Red Hat.
   [ISC-Bugs #22033], [Red Hat Bug #628258]
 
+- When processing the format flags for a given option consume the
+  flag indicating an optional value correctly.  A symptom of this
+  bug was an infinite loop when trying to parse the slp-service-scope
+  option.  Thanks to a patch from Marius Tomaschewski.
+  [ISC-Bugs #22055]
+
 			Changes since 4.2.0b2
 
 - Add declaration for variable in debug code in alloc.c.  [ISC-Bugs #21472]
@@ -2718,7 +2724,6 @@ work on other platforms. Please report any problems and suggested fixes to
 - Fix a bug in the DHCP client initial startup backoff interval, which
   would cause two DHCPDISCOVERS to be sent back-to-back on startup.
 
-
 		Changes since 3.0 Beta 2 Patchlevel 15
 
 - Some documentation tweaks.
diff --git a/common/parse.c b/common/parse.c
index f459d239c..40e95297a 100644
--- a/common/parse.c
+++ b/common/parse.c
@@ -4977,8 +4977,28 @@ struct option *option;
 		do {
 			if ((*fmt == 'A') || (*fmt == 'a'))
 				break;
-			if (*fmt == 'o')
+			if (*fmt == 'o') {
+				/* consume the optional flag */
+				fmt++;
 				continue;
+			}
+
+			if (fmt[1] == 'o') {
+				/*
+				 * A value for the current format is
+				 * optional - check to see if the next
+				 * token is a semi-colon if so we don't
+				 * need to parse it and doing so would
+				 * consume the semi-colon which our
+				 * caller is expecting to parse
+				 */
+				token = peek_token(&val, (unsigned *)0,
+						   cfile);
+				if (token == SEMI) {
+					fmt++;
+					continue;
+				}
+			}
 
 			tmp = *expr;
 			*expr = NULL;