From patchwork Mon Feb 27 10:29:53 2012 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Antonio Quartulli X-Patchwork-Id: 1602 Return-Path: Received: from confino.investici.org (investici.nine.ch [217.150.252.179]) by open-mesh.org (Postfix) with ESMTPS id B9B9A60081D for ; Mon, 27 Feb 2012 11:31:03 +0100 (CET) Authentication-Results: open-mesh.org; dkim=pass (1024-bit key) header.i=@autistici.org; dkim-adsp=pass Received: from [217.150.252.179] (confino [217.150.252.179]) (Authenticated sender: ordex@autistici.org) by localhost (Postfix) with ESMTPSA id 53087C8678; Mon, 27 Feb 2012 10:31:02 +0000 (UTC) X-DKIM: Sendmail DKIM Filter v2.8.2 confino.investici.org 53087C8678 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=autistici.org; s=stigmate; t=1330338662; bh=SMI27SmLg8Vll+oVlqylEmQid7yhKqdJYHRw1ZjmuY0=; h=From:To:Cc:Subject:Date:Message-Id; b=OlpBKPM+GyS/xJH+IeAXW70TDjfNIGqdqE/J3hLLcNuGqx09P4F4/4nEzFiyRJEp+ tQzPxrjJ3PsVaMPuxqlmkMquTV+QHDHJfPvt5tkEeNoOsyhyKermAsa7a1KyQjZ9bi AZdOPHhQ7k4RFBv8Mx2b04eyPsj1Uv54IWm4gRgI= From: Antonio Quartulli To: b.a.t.m.a.n@lists.open-mesh.org Date: Mon, 27 Feb 2012 11:29:53 +0100 Message-Id: <1330338593-17809-1-git-send-email-ordex@autistici.org> X-Mailer: git-send-email 1.7.3.4 Subject: [B.A.T.M.A.N.] [PATCH] batman-adv: fix wrong dhcp option list browsing X-BeenThere: b.a.t.m.a.n@lists.open-mesh.org X-Mailman-Version: 2.1.13 Precedence: list Reply-To: The list for a Better Approach To Mobile Ad-hoc Networking List-Id: The list for a Better Approach To Mobile Ad-hoc Networking List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 27 Feb 2012 10:31:03 -0000 In is_type_dhcprequest(), while parsing a DHCP message, if the entry we found in the option list is neither a padding nor the dhcp-type, we have to ignore it and jump as many bytes as its length + 1. The "+ 1" byte is given by the subtype field itself that has to be jumped too. Reported-by: Marek Lindner Signed-off-by: Antonio Quartulli --- gateway_client.c | 6 +++--- 1 files changed, 3 insertions(+), 3 deletions(-) diff --git a/gateway_client.c b/gateway_client.c index 65a77a1..1f7e92d 100644 --- a/gateway_client.c +++ b/gateway_client.c @@ -563,10 +563,10 @@ static bool is_type_dhcprequest(struct sk_buff *skb, int header_len) p++; /* ...and then we jump over the data */ - if (pkt_len < *p) + if (pkt_len < 1 + (*p)) goto out; - pkt_len -= *p; - p += (*p); + pkt_len -= 1 + (*p); + p += 1 + (*p); } } out: