Check hardware address length in packet, toss packet if it's unreasonable. Dhcp...

diff --git a/common/options.c b/common/options.c
index 8a523e9a52a100d843b9cbc5c9bae3b9bda123e4..601facce395a3de055e2318d4920623673793e05 100644 (file)
--- a/common/options.c
+++ b/common/options.c
@@ -42,7 +42,7 @@
 
 #ifndef lint
 static char copyright[] =
-"$Id: options.c,v 1.26.2.1 1998/05/18 05:24:23 mellon Exp $ Copyright (c) 1995, 1996 The Internet Software Consortium.  All rights reserved.\n";
+"$Id: options.c,v 1.26.2.2 1998/06/25 05:49:39 mellon Exp $ Copyright (c) 1995, 1996 The Internet Software Consortium.  All rights reserved.\n";
 #endif /* not lint */
 
 #define DHCP_OPTION_DATA
@@ -571,20 +571,23 @@ char *pretty_print_option (code, data, len, emit_commas, emit_quotes)
        return optbuf;
 }
 
-void do_packet (interface, packbuf, len, from_port, from, hfrom)
+void do_packet (interface, packet, len, from_port, from, hfrom)
        struct interface_info *interface;
-       unsigned char *packbuf;
+       struct dhcp_packet *packet;
        int len;
        unsigned short from_port;
        struct iaddr from;
        struct hardware *hfrom;
 {
        struct packet tp;
-       struct dhcp_packet tdp;
 
-       memcpy (&tdp, packbuf, len);
+       if (packet -> hlen > sizeof packet -> chaddr) {
+               note ("Discarding packet with invalid hlen.");
+               return;
+       }
+
        memset (&tp, 0, sizeof tp);
-       tp.raw = &tdp;
+       tp.raw = packet;
        tp.packet_length = len;
        tp.client_port = from_port;
        tp.client_addr = from;

diff --git a/relay/dhcrelay.c b/relay/dhcrelay.c
index 0548a43b9a81984151446cf1c50730a66b89edb4..5c0091b789e19c0228298ed7a1b9ba10edbf0b77 100644 (file)
--- a/relay/dhcrelay.c
+++ b/relay/dhcrelay.c
@@ -42,7 +42,7 @@
 
 #ifndef lint
 static char copyright[] =
-"$Id: dhcrelay.c,v 1.9.2.1 1997/12/09 20:19:52 mellon Exp $ Copyright (c) 1997 The Internet Software Consortium.  All rights reserved.\n";
+"$Id: dhcrelay.c,v 1.9.2.2 1998/06/25 05:50:23 mellon Exp $ Copyright (c) 1997 The Internet Software Consortium.  All rights reserved.\n";
 #endif /* not lint */
 
 #include "dhcpd.h"
@@ -223,20 +223,24 @@ int main (argc, argv, envp)
        return 0;
 }
 
-void relay (ip, packbuf, length, from_port, from, hfrom)
+void relay (ip, packet, length, from_port, from, hfrom)
        struct interface_info *ip;
-       u_int8_t *packbuf;
+       struct dhcp_packet *packet;
        int length;
        u_int16_t from_port;
        struct iaddr from;
        struct hardware *hfrom;
 {
-       struct dhcp_packet *packet = (struct dhcp_packet *)packbuf;
        struct server_list *sp;
        struct sockaddr_in to;
        struct interface_info *out;
        struct hardware hto;
 
+       if (packet -> hlen > sizeof packet -> chaddr) {
+               note ("Discarding packet with invalid hlen.");
+               return;
+       }
+
        /* If it's a bootreply, forward it to the client. */
        if (packet -> op == BOOTREPLY) {
 #ifndef USE_FALLBACK