Security fix, CVE-2017-14492, DHCPv6 RA heap overflow.

Fix heap overflow in IPv6 router advertisement code.
This is a potentially serious security hole, as a
crafted RA request can overflow a buffer and crash or
control dnsmasq. Attacker must be on the local network.

http://thekelleys.org.uk/gitweb/?p=dnsmasq.git;a=commit;h=24036ea507862c7b7898b68289c8130f85599c10

Change-Id: I3218bd52bda0c540a1c52d378b8d1b6e9ed50455
Signed-off-by: Seonah Moon <seonah1.moon@samsung.com>

diff --git a/src/radv.c b/src/radv.c
index 39f1e92..9db0095 100644 (file)
--- a/src/radv.c
+++ b/src/radv.c
@@ -197,6 +197,9 @@ void icmp6_packet(time_t now)
       /* look for link-layer address option for logging */
       if (sz >= 16 && packet[8] == ICMP6_OPT_SOURCE_MAC && (packet[9] * 8) + 8 <= sz)
        {
+         if ((packet[9] * 8 - 2) * 3 - 1 >= MAXDNAME) {
+           return;
+         }
          print_mac(daemon->namebuff, &packet[10], (packet[9] * 8) - 2);
          mac = daemon->namebuff;
        }