anchao opened a new pull request, #3897: URL: https://github.com/apache/nuttx-apps/pull/3897
dhcpd_parseoptions() read the option length byte for every non-PAD/non-END option without first checking that two bytes remained in the current options field. A malformed packet ending with a single non-PAD option byte could therefore read one byte past the end of the options array. Check that the option header is present before reading the length byte, and reject options whose declared length extends beyond the current field. Also allow options that exactly consume the remaining field bytes, and avoid using a stale option length when switching to overloaded file/sname option fields. This prevents malformed DHCP client requests from causing out-of-bounds reads during DHCP server option parsing. *Note: Please adhere to [Contributing Guidelines](https://github.com/apache/nuttx/blob/master/CONTRIBUTING.md).* ## Summary *Update this section with information on why change is necessary, what it exactly does and how, if new feature shows up, provide references (dependencies, similar problems and solutions), etc.* ## Impact *Update this section, where applicable, on how change affects users, build process, hardware, documentation, security, compatibility, etc.* ## Testing *Update this section with details on how did you verify the change, what Host was used for build (OS, CPU, compiler, ..), what Target was used for verification (arch, board:config, ..), etc. Providing build and runtime logs from before and after change is highly appreciated.* -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
