From: Michael Brown <mcb30@ipxe.org>
Date: Tue, 4 Aug 2026 17:37:12 +0000 (+0100)
Subject: [ipv4] Remove harmless but technically undefined left shift
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=092ab54ebc57ab35ceddd717701c7c94d732a4e9;p=thirdparty%2Fipxe.git

[ipv4] Remove harmless but technically undefined left shift

A DHCP static route option is capable of encoding an invalid subnet
mask width of greater than 32 bits.  This leads to a technically
undefined left shift when calculating the 32-bit subnet mask.

There is no security impact of this undefined shift: the only possible
outcome is that the subnet mask for the improperly defined static
route ends up holding an invalid value.

Fix by checking the range before performing the shift, to eliminate
future reporting noise.

Signed-off-by: Michael Brown <mcb30@ipxe.org>
---

diff --git a/src/net/ipv4.c b/src/net/ipv4.c
index f3dd44384..bda8bae05 100644
--- a/src/net/ipv4.c
+++ b/src/net/ipv4.c
@@ -167,8 +167,9 @@ static int ipv4_add_static ( struct net_device *netdev, struct in_addr address,
 		remaining--;
 		masklen = ( ( width + 7 ) / 8 );
 
-		/* Check remaining length */
-		if ( ( masklen + sizeof ( gateway ) ) > remaining ) {
+		/* Check remaining length and mask validity */
+		if ( ( ( masklen + sizeof ( gateway ) ) > remaining ) ||
+		     ( width > 32 ) ) {
 			DBGC ( netdev, "IPv4 invalid static route:\n" );
 			DBGC_HDA ( netdev, 0, routes, len );
 			return -EINVAL;