From: Francis Dupont <fdupont@isc.org>
Date: Wed, 20 May 2015 13:41:36 +0000 (+0200)
Subject: [master] fixed 3 minor bugs in DHCP++ (#3854)
X-Git-Tag: trac3652_base~10
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=de263ad0008f3494a85592f78db1ec662b68e689;p=thirdparty%2Fkea.git

[master] fixed 3 minor bugs in DHCP++ (#3854)
---

diff --git a/ChangeLog b/ChangeLog
index 16e36c059f..498e074a22 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,7 @@
+935.	[bug]		fdupont
+	Fixed 3 out of bounds accesses on vectors in DHCP++ code.
+	(Trac #3854, git xxx)
+
 934.	[bug]		fdupont
 	Renamed the DHCP-DDNS constant INVALID_SOCKET to SOCKET_NOT_VALID
 	to avoid conflicting with a constant of that name defined on some
diff --git a/src/lib/dhcp/pkt4.cc b/src/lib/dhcp/pkt4.cc
index 5435a2dad8..46506ce4f4 100644
--- a/src/lib/dhcp/pkt4.cc
+++ b/src/lib/dhcp/pkt4.cc
@@ -124,7 +124,7 @@ Pkt4::pack() {
         buffer_out_.writeUint32(giaddr_);
 
 
-        if (hw_len <= MAX_CHADDR_LEN) {
+        if ((hw_len > 0) && (hw_len <= MAX_CHADDR_LEN)) {
             // write up to 16 bytes of the hardware address (CHADDR field is 16
             // bytes long in DHCPv4 message).
             buffer_out_.writeData(&hwaddr_->hwaddr_[0],
@@ -136,8 +136,10 @@ Pkt4::pack() {
         }
 
         // write (len) bytes of padding
-        vector<uint8_t> zeros(hw_len, 0);
-        buffer_out_.writeData(&zeros[0], hw_len);
+        if (hw_len > 0) {
+            vector<uint8_t> zeros(hw_len, 0);
+            buffer_out_.writeData(&zeros[0], hw_len);
+        }
 
         buffer_out_.writeData(sname_, MAX_SNAME_LEN);
         buffer_out_.writeData(file_, MAX_FILE_LEN);
diff --git a/src/lib/dhcp/pkt6.cc b/src/lib/dhcp/pkt6.cc
index e2c5ff8ec4..1d04200b5e 100644
--- a/src/lib/dhcp/pkt6.cc
+++ b/src/lib/dhcp/pkt6.cc
@@ -378,7 +378,7 @@ Pkt6::unpackRelayMsg() {
         bufsize -= DHCPV6_RELAY_HDR_LEN; // 34 bytes (1+1+16+16)
 
         // parse the rest as options
-        OptionBuffer opt_buffer(&data_[offset], &data_[offset+bufsize]);
+        OptionBuffer opt_buffer(&data_[offset], &data_[offset] + bufsize);
 
         // If custom option parsing function has been set, use this function
         // to parse options. Otherwise, use standard function from libdhcp.