riot-ci/RIOT
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

net/dhcpv6: Introduce buffer size check

Browse Source
This commit is contained in:
Jan Romann 2020-11-29 02:56:29 +01:00
parent 517e082cf5
commit 9823e45a93
1 changed files with 9 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
sys/net/application_layer/dhcpv6/client.c
View File

@ -289,7 +289,7 @@ static inline size_t _compose_ia_pd_opt(dhcpv6_opt_ia_pd_t *ia_pd,
return len + sizeof(dhcpv6_opt_t); return len + sizeof(dhcpv6_opt_t);
} }
static inline size_t _add_ia_pd_from_config(uint8_t *buf) static inline size_t _add_ia_pd_from_config(uint8_t *buf, size_t len_max)
{ {
size_t msg_len = 0; size_t msg_len = 0;
@ -301,6 +301,12 @@ static inline size_t _add_ia_pd_from_config(uint8_t *buf)
msg_len += _compose_ia_pd_opt(ia_pd, ia_id, 0U); msg_len += _compose_ia_pd_opt(ia_pd, ia_id, 0U);
} }
} }
if (msg_len > len_max) {
assert(0);
return 0;
}
return msg_len; return msg_len;
} }
@ -732,7 +738,7 @@ static void _solicit_servers(event_t *event)
mud_url, sizeof(send_buf) - msg_len); mud_url, sizeof(send_buf) - msg_len);
} }
msg_len += _add_ia_pd_from_config(&send_buf[msg_len]); msg_len += _add_ia_pd_from_config(&send_buf[msg_len], sizeof(send_buf) - msg_len);
DEBUG("DHCPv6 client: send SOLICIT\n"); DEBUG("DHCPv6 client: send SOLICIT\n");
_flush_stale_replies(&sock); _flush_stale_replies(&sock);
res = sock_udp_send(&sock, send_buf, msg_len, &remote); res = sock_udp_send(&sock, send_buf, msg_len, &remote);
@ -840,7 +846,7 @@ static void _request_renew_rebind(uint8_t type)
msg_len += _compose_elapsed_time_opt(time); msg_len += _compose_elapsed_time_opt(time);
msg_len += _compose_oro_opt((dhcpv6_opt_oro_t *)&send_buf[msg_len], oro_opts, msg_len += _compose_oro_opt((dhcpv6_opt_oro_t *)&send_buf[msg_len], oro_opts,
ARRAY_SIZE(oro_opts)); ARRAY_SIZE(oro_opts));
msg_len += _add_ia_pd_from_config(&send_buf[msg_len]); msg_len += _add_ia_pd_from_config(&send_buf[msg_len], sizeof(send_buf) - msg_len);
_flush_stale_replies(&sock); _flush_stale_replies(&sock);
while (sock_udp_send(&sock, send_buf, msg_len, &remote) <= 0) {} while (sock_udp_send(&sock, send_buf, msg_len, &remote) <= 0) {}
while (((res = sock_udp_recv(&sock, recv_buf, sizeof(recv_buf), while (((res = sock_udp_recv(&sock, recv_buf, sizeof(recv_buf),