Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 9205cc52 authored by Antonio Quartulli's avatar Antonio Quartulli
Browse files

batman-adv: fix wrong dhcp option list browsing 



In is_type_dhcprequest(), while parsing a DHCP message, if the entry we found in
the option list is neither a padding nor the dhcp-type, we have to ignore it and
jump as many bytes as its length + 1. The "+ 1" byte is given by the subtype
field itself that has to be jumped too.

Reported-by: default avatarMarek Lindner <lindner_marek@yahoo.de>
Signed-off-by: default avatarAntonio Quartulli <ordex@autistici.org>
parent 06a4c1c5

net/batman-adv/gateway_client.c

+3 −3
Original line number Diff line number Diff line
@@ -558,10 +558,10 @@ static bool is_type_dhcprequest(struct sk_buff *skb, int header_len) 
			p++;



			/* ...and then we jump over the data */

			if (pkt_len < *p)

			if (pkt_len < 1 + (*p))

				goto out;

			pkt_len -= *p;

			p += (*p);

			pkt_len -= 1 + (*p);

			p += 1 + (*p);

		}

	}

out: