Embedded_Projects/u-boot
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

net: dhcp6: Fix OPT_BOOTFILE_PARAM parsing

Browse Source 
RFC 5970 states that OPT_BOOTFILE_PARAM (option 60) can be
multiple parameters that start with a 16-bit length field followed
by the parameter. For example:
[ param-len 1 (16-bits) ] [ parameter 1 (variable length) ]

This fix ensure we're considering "param-len 1" in the parsing.

Signed-off-by: Sean Edmond <seanedmond@microsoft.com>
This commit is contained in:
Sean Edmond 2023-07-25 16:13:29 -07:00 committed by Tom Rini
parent 5d260d0800
commit b2369a19b8
1 changed files with 12 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
net/dhcpv6.c
View File

@ -304,7 +304,7 @@ static void dhcp6_parse_ia_options(struct dhcp6_option_hdr *ia_ptr, uchar *ia_op
static void dhcp6_parse_options(uchar *rx_pkt, unsigned int len)
{
uchar *option_ptr;
int sol_max_rt_sec, option_len;
int sol_max_rt_sec, option_len, param_len_1;
char *s, *e;
struct dhcp6_option_hdr *option_hdr;
@ -390,14 +390,23 @@ static void dhcp6_parse_options(uchar *rx_pkt, unsigned int len)
case DHCP6_OPTION_OPT_BOOTFILE_PARAM:
if (IS_ENABLED(CONFIG_DHCP6_PXE_DHCP_OPTION)) {
debug("DHCP6_OPTION_OPT_BOOTFILE_PARAM FOUND\n");
/* if CONFIG_DHCP6_PXE_DHCP_OPTION is set the PXE config file path
* is contained in the first OPT_BOOTFILE_PARAM argument
*/
param_len_1 = ntohs(*((u16 *)option_ptr));
option_ptr += sizeof(u16);
if (param_len_1 + sizeof(u16) > option_len) {
debug("Invalid BOOTFILE_PARAM param_len_1. Skipping\n");
break;
}
if (pxelinux_configfile)
free(pxelinux_configfile);
pxelinux_configfile = (char *)malloc((option_len + 1) *
pxelinux_configfile = (char *)malloc((param_len_1 + 1) *
sizeof(char));
if (pxelinux_configfile)
strlcpy(pxelinux_configfile, option_ptr, option_len + 1);
strlcpy(pxelinux_configfile, option_ptr, param_len_1 + 1);
else
printf("Error: Failed to allocate pxelinux_configfile\n");