udhcpc: check read of option length byte to be within packet

function                                             old     new   delta
udhcp_get_option                                     215     220      +5
udhcp_run_script                                     802     803      +1

Signed-off-by: Brian Foley <bpfoley@google.com>
Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>

1 files changed, 7 insertions, 1 deletions

diff --git a/networking/udhcp/common.c b/networking/udhcp/common.c
index 0cf4dab63..589bcd674 100644
--- a/networking/udhcp/common.c
+++ b/networking/udhcp/common.c
@@ -226,9 +226,12 @@ uint8_t* FAST_FUNC udhcp_get_option(struct dhcp_packet *packet, int code)
         rem = sizeof(packet->options);
         while (1) {
                 if (rem <= 0) {
+ complain:
                         bb_error_msg("bad packet, malformed option field");
                         return NULL;
                 }
+
+                /* DHCP_PADDING and DHCP_END have no [len] byte */
                 if (optionptr[OPT_CODE] == DHCP_PADDING) {
                         rem--;
                         optionptr++;
@@ -251,10 +254,13 @@ uint8_t* FAST_FUNC udhcp_get_option(struct dhcp_packet *packet, int code)
                         }
                         break;
                 }
+
+                if (rem <= OPT_LEN)
+                        goto complain; /* complain and return NULL */
                 len = 2 + optionptr[OPT_LEN];
                 rem -= len;
                 if (rem < 0)
-                        continue; /* complain and return NULL */
+                        goto complain; /* complain and return NULL */
 
                 if (optionptr[OPT_CODE] == code) {
                         log_option("option found", optionptr);