From 37a4fffb1796a67dff70cf337128a6e9dfd60cb5 Mon Sep 17 00:00:00 2001 From: Benjamin Valentin Date: Wed, 2 Mar 2022 16:28:59 +0100 Subject: [PATCH] sys/net/dhcpv6: consider option 0 an end marker The REPLY of a TP-Link router (WR400 v4.20) ends with a 0 option that has a bogus length. When subtracting the length from the remaining length, we get an underflow (remaining `len` is 3, option len is 4). To get a working DHCP response, consider 0 (Reserved) an end marker. --- sys/net/application_layer/dhcpv6/client.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/sys/net/application_layer/dhcpv6/client.c b/sys/net/application_layer/dhcpv6/client.c index cc2d2f7f63..237a86a44a 100644 --- a/sys/net/application_layer/dhcpv6/client.c +++ b/sys/net/application_layer/dhcpv6/client.c @@ -1016,6 +1016,10 @@ static bool _parse_reply(uint8_t *rep, size_t len, uint8_t request_type) default: break; } + /* 0 option is used as an end marker, len can include bogus bytes */ + if (!byteorder_ntohs(opt->type)) { + break; + } } if ((cid == NULL) || (sid == NULL)) { DEBUG("DHCPv6 client: ADVERTISE does not contain either server ID "