From patchwork Fri May 11 12:21:18 2012 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Antonio Quartulli X-Patchwork-Id: 1869 Return-Path: Received: from confino.investici.org (investici.nine.ch [217.150.252.179]) by open-mesh.org (Postfix) with ESMTPS id 27EA060087E for ; Fri, 11 May 2012 14:24:54 +0200 (CEST) Authentication-Results: open-mesh.org; dkim=pass (1024-bit key) header.i=@autistici.org; dkim-adsp=pass Received: from [217.150.252.179] (confino [217.150.252.179]) (Authenticated sender: ordex@autistici.org) by localhost (Postfix) with ESMTPSA id 4B2A6C8825; Fri, 11 May 2012 12:24:51 +0000 (UTC) X-DKIM: Sendmail DKIM Filter v2.8.2 confino.investici.org 4B2A6C8825 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=autistici.org; s=stigmate; t=1336739092; bh=fwXYUyl9C/VGaiAX/8hPqIAf+sxqBwivMjRxl61q/pQ=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References; b=levXDBBMlRWbB+tuPUtuOEZNh3H6nQM1MmC064NC6eqrRot3mqc2RZQ7JhevD6Abt kx/7raEErVOrheZMCPSKZy2fMgaIF4ja/PMGNdoe9BCoIjbAx8wbJ4uhWcQFqSk8XZ bi1898hFgUWGd+Ime5uJ+48tYeEqNJo1o4JpeAF8= From: Antonio Quartulli To: davem@davemloft.net Date: Fri, 11 May 2012 14:21:18 +0200 Message-Id: <1336738892-7401-2-git-send-email-ordex@autistici.org> X-Mailer: git-send-email 1.7.9.4 In-Reply-To: <1336738892-7401-1-git-send-email-ordex@autistici.org> References: <1336738892-7401-1-git-send-email-ordex@autistici.org> Cc: netdev@vger.kernel.org, b.a.t.m.a.n@lists.open-mesh.org Subject: [B.A.T.M.A.N.] [PATCH 01/15] batman-adv: fix wrong dhcp option list browsing X-BeenThere: b.a.t.m.a.n@lists.open-mesh.org X-Mailman-Version: 2.1.13 Precedence: list Reply-To: The list for a Better Approach To Mobile Ad-hoc Networking List-Id: The list for a Better Approach To Mobile Ad-hoc Networking List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 11 May 2012 12:24:54 -0000 In is_type_dhcprequest(), while parsing a DHCP message, if the entry we found in the option list is neither a padding nor the dhcp-type, we have to ignore it and jump as many bytes as its length + 1. The "+ 1" byte is given by the subtype field itself that has to be jumped too. Reported-by: Marek Lindner Signed-off-by: Antonio Quartulli --- net/batman-adv/gateway_client.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/net/batman-adv/gateway_client.c b/net/batman-adv/gateway_client.c index 6f9b9b7..47f7186 100644 --- a/net/batman-adv/gateway_client.c +++ b/net/batman-adv/gateway_client.c @@ -558,10 +558,10 @@ static bool is_type_dhcprequest(struct sk_buff *skb, int header_len) p++; /* ...and then we jump over the data */ - if (pkt_len < *p) + if (pkt_len < 1 + (*p)) goto out; - pkt_len -= *p; - p += (*p); + pkt_len -= 1 + (*p); + p += 1 + (*p); } } out: