dhcp-server: fix integer underflow

Let's better ignore an invalid message size parameter, than assume ridiculously larger sizes.
2016-05-30 18:28:51 +02:00
parent ac96418b4f
commit 76a9d0f171
1 changed files with 2 additions and 1 deletions
@@ -633,7 +633,8 @@ static int parse_request(uint8_t code, uint8_t len, const void *option, void *us

                break;
        case SD_DHCP_OPTION_MAXIMUM_MESSAGE_SIZE:
-                if (len == 2)
+
+                if (len == 2 && unaligned_read_be16(option) >= sizeof(DHCPPacket))
                        req->max_optlen = unaligned_read_be16(option) - sizeof(DHCPPacket);

                break;