udhcpd: fix a bug in add_lease where it was reading at [-1]

It is not correct when we read lease file!

Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>

4 files changed, 35 insertions, 21 deletions

diff --git a/networking/udhcp/dhcpd.h b/networking/udhcp/dhcpd.h
index 67cb78ce7..4f6b73e34 100644
--- a/networking/udhcp/dhcpd.h
+++ b/networking/udhcp/dhcpd.h
@@ -89,7 +89,7 @@ struct dyn_lease {
 	 * (dhcp packet has chaddr[16], not [6])
 	 */
 	uint8_t lease_mac[6];
-	uint8_t hostname[20];
+	char hostname[20];
 	uint8_t pad[2];
 	/* total size is a multiply of 4 */
 } PACKED;
@@ -98,7 +98,8 @@ extern struct dyn_lease *g_leases;
 
 struct dyn_lease *add_lease(
 		const uint8_t *chaddr, uint32_t yiaddr,
-		leasetime_t leasetime, uint8_t *hostname
+		leasetime_t leasetime,
+		const char *hostname, int hostname_len
 		) FAST_FUNC;
 int is_expired_lease(struct dyn_lease *lease) FAST_FUNC;
 struct dyn_lease *find_lease_by_mac(const uint8_t *mac) FAST_FUNC;
diff --git a/networking/udhcp/files.c b/networking/udhcp/files.c
index 35592153b..1b2cc96f4 100644
--- a/networking/udhcp/files.c
+++ b/networking/udhcp/files.c
@@ -420,7 +420,11 @@ void FAST_FUNC read_leases(const char *file)
 				continue;
 			/* NB: add_lease takes "relative time", IOW,
 			 * lease duration, not lease deadline. */
-			if (!(add_lease(lease.lease_mac, lease.lease_nip, expires, lease.hostname))) {
+			if (add_lease(lease.lease_mac, lease.lease_nip,
+					expires,
+					lease.hostname, sizeof(lease.hostname)
+				) == 0
+			) {
 				bb_error_msg("too many leases while loading %s", file);
 				break;
 			}
diff --git a/networking/udhcp/leases.c b/networking/udhcp/leases.c
index 68fba726e..afd41bfd4 100644
--- a/networking/udhcp/leases.c
+++ b/networking/udhcp/leases.c
@@ -50,10 +50,10 @@ static void clear_lease(const uint8_t *chaddr, uint32_t yiaddr)
 /* Add a lease into the table, clearing out any old ones */
 struct dyn_lease* FAST_FUNC add_lease(
 		const uint8_t *chaddr, uint32_t yiaddr,
-		leasetime_t leasetime, uint8_t *hostname)
+		leasetime_t leasetime,
+		const char *hostname, int hostname_len)
 {
 	struct dyn_lease *oldest;
-	uint8_t hostname_length;
 
 	/* clean out any old ones */
 	clear_lease(chaddr, yiaddr);
@@ -63,16 +63,15 @@ struct dyn_lease* FAST_FUNC add_lease(
 	if (oldest) {
 		oldest->hostname[0] = '\0';
 		if (hostname) {
-			/* option size byte, + 1 for NUL */
-        		hostname_length = hostname[-1] + 1;
-			if (hostname_length > sizeof(oldest->hostname))
-				hostname_length = sizeof(oldest->hostname);
-            		hostname = (uint8_t*) safe_strncpy((char*)oldest->hostname, (char*)hostname, hostname_length);
+			char *p;
+			if (hostname_len > sizeof(oldest->hostname))
+				hostname_len = sizeof(oldest->hostname);
+            		p = safe_strncpy(oldest->hostname, hostname, hostname_len);
 			/* sanitization (s/non-ASCII/^/g) */
-			while (*hostname) {
-				if (*hostname < ' ' || *hostname > 126)
-					*hostname = '^';
-				hostname++;
+			while (*p) {
+				if (*p < ' ' || *p > 126)
+					*p = '^';
+				p++;
 			}
 		}
 		memcpy(oldest->lease_mac, chaddr, 6);
@@ -137,7 +136,7 @@ static int nobody_responds_to_arp(uint32_t nip, const uint8_t *safe_mac)
 	temp.s_addr = nip;
 	bb_info_msg("%s belongs to someone, reserving it for %u seconds",
 		inet_ntoa(temp), (unsigned)server_config.conflict_time);
-	add_lease(blank_chaddr, nip, server_config.conflict_time, NULL);
+	add_lease(blank_chaddr, nip, server_config.conflict_time, NULL, 0);
 	return 0;
 }
 
diff --git a/networking/udhcp/serverpacket.c b/networking/udhcp/serverpacket.c
index c3724e0e2..b48e4159a 100644
--- a/networking/udhcp/serverpacket.c
+++ b/networking/udhcp/serverpacket.c
@@ -130,7 +130,8 @@ int FAST_FUNC send_offer(struct dhcp_packet *oldpacket)
 	uint32_t req_nip;
 	uint32_t lease_time_sec = server_config.max_lease_sec;
 	uint32_t static_lease_ip;
-	uint8_t *req_ip_opt, *p_host_name;
+	uint8_t *req_ip_opt;
+	const char *p_host_name;
 	struct option_set *curr;
 	struct in_addr addr;
 
@@ -173,8 +174,13 @@ int FAST_FUNC send_offer(struct dhcp_packet *oldpacket)
 			bb_error_msg("no IP addresses to give - OFFER abandoned");
 			return -1;
 		}
-		p_host_name = get_option(oldpacket, DHCP_HOST_NAME);
-		if (!add_lease(packet.chaddr, packet.yiaddr, server_config.offer_time, p_host_name)) {
+		p_host_name = (const char*) get_option(oldpacket, DHCP_HOST_NAME);
+		if (add_lease(packet.chaddr, packet.yiaddr,
+				server_config.offer_time,
+				p_host_name,
+				p_host_name ? (unsigned char)p_host_name[OPT_LEN - OPT_DATA] : 0
+			) == 0
+		) {
 			bb_error_msg("lease pool is full - OFFER abandoned");
 			return -1;
 		}
@@ -218,7 +224,7 @@ int FAST_FUNC send_ACK(struct dhcp_packet *oldpacket, uint32_t yiaddr)
 	struct option_set *curr;
 	uint32_t lease_time_sec;
 	struct in_addr addr;
-	uint8_t *p_host_name;
+	const char *p_host_name;
 
 	init_packet(&packet, oldpacket, DHCPACK);
 	packet.yiaddr = yiaddr;
@@ -242,8 +248,12 @@ int FAST_FUNC send_ACK(struct dhcp_packet *oldpacket, uint32_t yiaddr)
 	if (send_packet(&packet, 0) < 0)
 		return -1;
 
-	p_host_name = get_option(oldpacket, DHCP_HOST_NAME);
-	add_lease(packet.chaddr, packet.yiaddr, lease_time_sec, p_host_name);
+	p_host_name = (const char*) get_option(oldpacket, DHCP_HOST_NAME);
+	add_lease(packet.chaddr, packet.yiaddr,
+		lease_time_sec,
+		p_host_name,
+		p_host_name ? (unsigned char)p_host_name[OPT_LEN - OPT_DATA] : 0
+	);
 	if (ENABLE_FEATURE_UDHCPD_WRITE_LEASES_EARLY) {
 		/* rewrite the file with leases at every new acceptance */
 		write_leases();