diff mbox

batman-adv: fix wrong dhcp option list browsing

Message ID 1330338593-17809-1-git-send-email-ordex@autistici.org (mailing list archive)
State Accepted, archived
Commit 459c4e49ba2d590ebd9e15c2f9688fd687d077b6
Headers

Commit Message

Antonio Quartulli Feb. 27, 2012, 10:29 a.m. UTC 
  In is_type_dhcprequest(), while parsing a DHCP message, if the entry we found in
the option list is neither a padding nor the dhcp-type, we have to ignore it and
jump as many bytes as its length + 1. The "+ 1" byte is given by the subtype
field itself that has to be jumped too.

Reported-by: Marek Lindner <lindner_marek@yahoo.de>
Signed-off-by: Antonio Quartulli <ordex@autistici.org>
---
 gateway_client.c |    6 +++---
 1 files changed, 3 insertions(+), 3 deletions(-)

Comments

Marek Lindner Feb. 28, 2012, 5:46 a.m. UTC | #1 
On Monday, February 27, 2012 18:29:53 Antonio Quartulli wrote:
> In is_type_dhcprequest(), while parsing a DHCP message, if the entry we
> found in the option list is neither a padding nor the dhcp-type, we have
> to ignore it and jump as many bytes as its length + 1. The "+ 1" byte is
> given by the subtype field itself that has to be jumped too.

Applied in revision 459c4e4.

Thanks,
Marek
diff mbox

Patch

diff --git a/gateway_client.c b/gateway_client.c
index 65a77a1..1f7e92d 100644
--- a/gateway_client.c
+++ b/gateway_client.c
@@ -563,10 +563,10 @@  static bool is_type_dhcprequest(struct sk_buff *skb, int header_len)
 			p++;
 
 			/* ...and then we jump over the data */
-			if (pkt_len < *p)
+			if (pkt_len < 1 + (*p))
 				goto out;
-			pkt_len -= *p;
-			p += (*p);
+			pkt_len -= 1 + (*p);
+			p += 1 + (*p);
 		}
 	}
 out: