Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 3de04e98 authored by tintin's avatar tintin Committed by android-build-merger
Browse files

libnetutil: Check dhcp respose packet length am: 61f25d4a am: cee6d38c am: 29d05404

am: c29049f4

Change-Id: I6949ceb5c4dee7ea0c97cdc79f0ce0a1dde84651
parents 3a46bcc3 c29049f4
Loading
Loading
Loading
Loading
+14 −0
Original line number Original line Diff line number Diff line
@@ -219,6 +219,20 @@ int receive_packet(int s, struct dhcp_msg *msg)
     * to construct the pseudo header used in the checksum calculation.
     * to construct the pseudo header used in the checksum calculation.
     */
     */
    dhcp_size = ntohs(packet.udp.len) - sizeof(packet.udp);
    dhcp_size = ntohs(packet.udp.len) - sizeof(packet.udp);
    /*
     * check validity of dhcp_size.
     * 1) cannot be negative or zero.
     * 2) src buffer contains enough bytes to copy
     * 3) cannot exceed destination buffer
     */
    if ((dhcp_size <= 0) ||
        ((int)(nread - sizeof(struct iphdr) - sizeof(struct udphdr)) < dhcp_size) ||
        ((int)sizeof(struct dhcp_msg) < dhcp_size)) {
#if VERBOSE
        ALOGD("Malformed Packet");
#endif
        return -1;
    }
    saddr = packet.ip.saddr;
    saddr = packet.ip.saddr;
    daddr = packet.ip.daddr;
    daddr = packet.ip.daddr;
    nread = ntohs(packet.ip.tot_len);
    nread = ntohs(packet.ip.tot_len);