ACPR/android_system_core
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

libnetutil: Check dhcp respose packet length am: 61f25d4a36 am: cee6d38c55 am: 29d054046f am: c29049f4f8 am: 3de04e9840 am: 19702dc499 am: 8191e9ba87 am: 804323c195 am: 4f5f00d879

Browse source 
am: 3a1ff1ad71

Change-Id: Ibea1269632e1700617b55f0ede7a0d9cc6442871
This commit is contained in:
tintin 2017-11-02 03:21:57 +00:00 • committed by android-build-merger
commit bab7b1ecd9
1 changed files with 14 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

14
libnetutils/packet.c
View file

@ -219,6 +219,20 @@ int receive_packet(int s, struct dhcp_msg *msg)
* to construct the pseudo header used in the checksum calculation. * to construct the pseudo header used in the checksum calculation.
*/ */
dhcp_size = ntohs(packet.udp.len) - sizeof(packet.udp); dhcp_size = ntohs(packet.udp.len) - sizeof(packet.udp);
/*
* check validity of dhcp_size.
* 1) cannot be negative or zero.
* 2) src buffer contains enough bytes to copy
* 3) cannot exceed destination buffer
*/
if ((dhcp_size <= 0) ||
((int)(nread - sizeof(struct iphdr) - sizeof(struct udphdr)) < dhcp_size) ||
((int)sizeof(struct dhcp_msg) < dhcp_size)) {
#if VERBOSE
ALOGD("Malformed Packet");
#endif
return -1;
}
saddr = packet.ip.saddr; saddr = packet.ip.saddr;
daddr = packet.ip.daddr; daddr = packet.ip.daddr;
nread = ntohs(packet.ip.tot_len); nread = ntohs(packet.ip.tot_len);