diff options
| author | David S. Miller <davem@nuts.davemloft.net> | 2004-06-30 01:26:39 -0700 |
|---|---|---|
| committer | David S. Miller <davem@nuts.davemloft.net> | 2004-06-30 01:26:39 -0700 |
| commit | da829c388d48e5a87a734a5420ce92a875720d7e (patch) | |
| tree | 4ace3c3ebc97a53cc72e57e7be1e6220ef157b6d /net | |
| parent | b2acaf131f5d182b70ffa6049d013c20fdaa2f70 (diff) | |
| download | history-da829c388d48e5a87a734a5420ce92a875720d7e.tar.gz | |
[IPV4]: Bootp packet extension area is variable length.
1) Remove the magic 300 constant
2) Allow b->exten area to be zero or more
variable bytes in length.
Signed-off-by: David S. Miller <davem@redhat.com>
Diffstat (limited to 'net')
| -rw-r--r-- | net/ipv4/ipconfig.c | 11 |
1 files changed, 8 insertions, 3 deletions
diff --git a/net/ipv4/ipconfig.c b/net/ipv4/ipconfig.c index 19833d69dab8ed..4c3fb3e13787a6 100644 --- a/net/ipv4/ipconfig.c +++ b/net/ipv4/ipconfig.c @@ -818,7 +818,7 @@ static int __init ic_bootp_recv(struct sk_buff *skb, struct net_device *dev, str struct bootp_pkt *b; struct iphdr *h; struct ic_device *d; - int len; + int len, ext_len; /* Perform verifications before taking the lock. */ if (skb->pkt_type == PACKET_OTHERHOST) @@ -859,7 +859,11 @@ static int __init ic_bootp_recv(struct sk_buff *skb, struct net_device *dev, str goto drop; len = ntohs(b->udph.len) - sizeof(struct udphdr); - if (len < 300) + ext_len = len - (sizeof(*b) - + sizeof(struct iphdr) - + sizeof(struct udphdr) - + sizeof(b->exten)); + if (ext_len < 0) goto drop; /* Ok the front looks good, make sure we can get at the rest. */ @@ -894,7 +898,8 @@ static int __init ic_bootp_recv(struct sk_buff *skb, struct net_device *dev, str } /* Parse extensions */ - if (!memcmp(b->exten, ic_bootp_cookie, 4)) { /* Check magic cookie */ + if (ext_len >= 4 && + !memcmp(b->exten, ic_bootp_cookie, 4)) { /* Check magic cookie */ u8 *end = (u8 *) b + ntohs(b->iph.tot_len); u8 *ext; |