udhcpd: mangle hostnames starting with dash ("-option")

function                                             old     new   delta
add_lease                                            316     328     +12

Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>

1 files changed, 2 insertions, 0 deletions

diff --git a/networking/udhcp/dhcpd.c b/networking/udhcp/dhcpd.c
index 3e08ec011..9d6604943 100644
--- a/networking/udhcp/dhcpd.c
+++ b/networking/udhcp/dhcpd.c
@@ -192,6 +192,8 @@ static struct dyn_lease *add_lease(
                          * but merely make dumpleases output safe for shells to use.
                          * We accept "0-9A-Za-z._-", all other chars turn to dots.
                          */
+                        if (*p == '-')
+                                *p = '.'; /* defeat "-option" attacks too */
                         while (*p) {
                                 if (!isalnum(*p) && *p != '-' && *p != '_')
                                         *p = '.';