diff options
| author | Denys Vlasenko <vda.linux@googlemail.com> | 2016-02-26 15:54:56 +0100 |
|---|---|---|
| committer | Denys Vlasenko <vda.linux@googlemail.com> | 2016-02-26 15:54:56 +0100 |
| commit | 352f79acbd759c14399e39baef21fc4ffe180ac2 (patch) | |
| tree | ce5e4d90cb44d6320eca3fc1fc794654b9c01952 /networking/udhcp/dhcpc.c | |
| parent | 5bec08cebd559c906eb94b8b957afb9f0b8db338 (diff) | |
| download | busybox-352f79acbd759c14399e39baef21fc4ffe180ac2.tar.gz | |
udhcpc: fix OPTION_6RD parsing (could overflow its malloced buffer)
Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
Diffstat (limited to 'networking/udhcp/dhcpc.c')
| -rw-r--r-- | networking/udhcp/dhcpc.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/networking/udhcp/dhcpc.c b/networking/udhcp/dhcpc.c index 48097bc24..2fe84e1ca 100644 --- a/networking/udhcp/dhcpc.c +++ b/networking/udhcp/dhcpc.c @@ -113,7 +113,7 @@ static const uint8_t len_of_option_as_string[] = { [OPTION_IP ] = sizeof("255.255.255.255 "), [OPTION_IP_PAIR ] = sizeof("255.255.255.255 ") * 2, [OPTION_STATIC_ROUTES ] = sizeof("255.255.255.255/32 255.255.255.255 "), - [OPTION_6RD ] = sizeof("32 128 ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff 255.255.255.255 "), + [OPTION_6RD ] = sizeof("132 128 ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff 255.255.255.255 "), [OPTION_STRING ] = 1, [OPTION_STRING_HOST ] = 1, #if ENABLE_FEATURE_UDHCP_RFC3397 @@ -222,7 +222,7 @@ static NOINLINE char *xmalloc_optname_optval(uint8_t *option, const struct dhcp_ type = optflag->flags & OPTION_TYPE_MASK; optlen = dhcp_option_lengths[type]; upper_length = len_of_option_as_string[type] - * ((unsigned)(len + optlen - 1) / (unsigned)optlen); + * ((unsigned)(len + optlen) / (unsigned)optlen); dest = ret = xmalloc(upper_length + strlen(opt_name) + 2); dest += sprintf(ret, "%s=", opt_name); |