Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 4f5f00d8 authored by tintin's avatar tintin Committed by android-build-merger
Browse files

libnetutil: Check dhcp respose packet length am: 61f25d4a am: cee6d38c am:... 

libnetutil: Check dhcp respose packet length am: 61f25d4a am: cee6d38c am: 29d05404 am: c29049f4 am: 3de04e98 am: 19702dc4 am: 8191e9ba
am: 804323c1

Change-Id: I27c237896e46f15c258fda00a9ab23465691cb9e
parents 5bccb553 804323c1

libnetutils/packet.c

+14 −0
Original line number Diff line number Diff line
@@ -219,6 +219,20 @@ int receive_packet(int s, struct dhcp_msg *msg) 
     * to construct the pseudo header used in the checksum calculation.

     */

    dhcp_size = ntohs(packet.udp.len) - sizeof(packet.udp);

    /*

     * check validity of dhcp_size.

     * 1) cannot be negative or zero.

     * 2) src buffer contains enough bytes to copy

     * 3) cannot exceed destination buffer

     */

    if ((dhcp_size <= 0) ||

        ((int)(nread - sizeof(struct iphdr) - sizeof(struct udphdr)) < dhcp_size) ||

        ((int)sizeof(struct dhcp_msg) < dhcp_size)) {

#if VERBOSE

        ALOGD("Malformed Packet");

#endif

        return -1;

    }

    saddr = packet.ip.saddr;

    daddr = packet.ip.daddr;

    nread = ntohs(packet.ip.tot_len);