Fix resource leak

[platform/upstream/connman.git] / gdhcp / common.c

diff --git a/gdhcp/common.c b/gdhcp/common.c
index 1d667d1..c8916aa 100755 (executable)
--- a/gdhcp/common.c
+++ b/gdhcp/common.c
@@ -73,18 +73,21 @@ GDHCPOptionType dhcp_get_code_type(uint8_t code)
        return OPTION_UNKNOWN;
 }
 
-uint8_t *dhcp_get_option(struct dhcp_packet *packet, int code)
+uint8_t *dhcp_get_option(struct dhcp_packet *packet, uint16_t packet_len, int code)
 {
        int len, rem;
-       uint8_t *optionptr;
+       uint8_t *optionptr, *options_end;
+       size_t options_len;
        uint8_t overload = 0;
 
        /* option bytes: [code][len][data1][data2]..[dataLEN] */
        optionptr = packet->options;
        rem = sizeof(packet->options);
+       options_len = packet_len - (sizeof(*packet) - sizeof(packet->options));
+       options_end = optionptr + options_len - 1;
 
        while (1) {
-               if (rem <= 0)
+               if ((rem <= 0) && (optionptr + OPT_CODE > options_end))
                        /* Bad packet, malformed option field */
                        return NULL;
 
@@ -115,14 +118,25 @@ uint8_t *dhcp_get_option(struct dhcp_packet *packet, int code)
                        break;
                }
 
+               if (optionptr + OPT_LEN > options_end) {
+                       /* bad packet, would read length field from OOB */
+                       return NULL;
+               }
+
                len = 2 + optionptr[OPT_LEN];
 
                rem -= len;
                if (rem < 0)
                        continue; /* complain and return NULL */
 
-               if (optionptr[OPT_CODE] == code)
-                       return optionptr + OPT_DATA;
+               if (optionptr[OPT_CODE] == code) {
+                       if (optionptr + len > options_end) {
+                               /* bad packet, option length points OOB */
+                               return NULL;
+                       } else {
+                               return optionptr + OPT_DATA;
+                       }
+               }
 
                if (optionptr[OPT_CODE] == DHCP_OPTION_OVERLOAD)
                        overload |= optionptr[OPT_DATA];