From ab4f9eeb7b56c03d42db8eeb8ffe6df4b8b53e28 Mon Sep 17 00:00:00 2001
From: Yu Watanabe <watanabe.yu+github@gmail.com>
Date: Mon, 24 Jan 2022 04:49:30 +0900
Subject: [PATCH 1/2] sd-dhcp-server: fix heap buffer overflow

This checks client hardware length earlier.
---
 src/libsystemd-network/sd-dhcp-server.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/src/libsystemd-network/sd-dhcp-server.c b/src/libsystemd-network/sd-dhcp-server.c
index 38c202975f..ec9202d02e 100644
--- a/src/libsystemd-network/sd-dhcp-server.c
+++ b/src/libsystemd-network/sd-dhcp-server.c
@@ -724,6 +724,9 @@ static int ensure_sane_request(sd_dhcp_server *server, DHCPRequest *req, DHCPMes
 
         req->message = message;
 
+        if (message->hlen > sizeof(message->chaddr))
+                return -EBADMSG;
+
         /* set client id based on MAC address if client did not send an explicit one */
         if (!req->client_id.data) {
                 uint8_t *data;
@@ -742,9 +745,6 @@ static int ensure_sane_request(sd_dhcp_server *server, DHCPRequest *req, DHCPMes
                 req->client_id.data = data;
         }
 
-        if (message->hlen > sizeof(message->chaddr))
-                return -EBADMSG;
-
         if (message->hlen == 0 || memeqzero(message->chaddr, message->hlen)) {
                 /* See RFC2131 section 4.1.1.
                  * hlen and chaddr may not be set for non-ethernet interface.

From a5966318080b7d48beeefa2e9c0fee3dc62c414e Mon Sep 17 00:00:00 2001
From: Yu Watanabe <watanabe.yu+github@gmail.com>
Date: Mon, 24 Jan 2022 04:52:33 +0900
Subject: [PATCH 2/2] fuzz: add testcases of heap-buffer-overflow for
 sd-dhcp-server

---
 ...crash-64c861ad981838e509920e8538640ef46feaae66 | Bin 0 -> 251 bytes
 ...crash-e13ccbc34d0fa5add0ee1eb69ed630dd2cdfb1ca | Bin 0 -> 264 bytes
 2 files changed, 0 insertions(+), 0 deletions(-)
 create mode 100644 test/fuzz/fuzz-dhcp-server/crash-64c861ad981838e509920e8538640ef46feaae66
 create mode 100644 test/fuzz/fuzz-dhcp-server/crash-e13ccbc34d0fa5add0ee1eb69ed630dd2cdfb1ca

diff --git a/test/fuzz/fuzz-dhcp-server/crash-64c861ad981838e509920e8538640ef46feaae66 b/test/fuzz/fuzz-dhcp-server/crash-64c861ad981838e509920e8538640ef46feaae66
new file mode 100644
index 0000000000000000000000000000000000000000..a61ee0bc9f77ae5f7301a24948c951e2d475b195
GIT binary patch
literal 251
zcmZQ%{>AW{fkES!F9(Ay6f!ch!I-#d28zKPEGCFEFc>kIGBO*pFfgn+?7(2jV8&p`
uXk-YaEE#A07lCUrX3_uu-InP;PQVCJY7JA60Av7#Y#9<57=UsnjQ;^Qt2l!I

literal 0
HcmV?d00001

diff --git a/test/fuzz/fuzz-dhcp-server/crash-e13ccbc34d0fa5add0ee1eb69ed630dd2cdfb1ca b/test/fuzz/fuzz-dhcp-server/crash-e13ccbc34d0fa5add0ee1eb69ed630dd2cdfb1ca
new file mode 100644
index 0000000000000000000000000000000000000000..1bd216c8c86488bb491d5029d4a36c9bab22c411
GIT binary patch
literal 264
zcmb78ISv9b5c8Obf{H&-P^}2cE=z<Wcnxpk8Pq_rf1yNLaE=dPjVAHfV~wHW{rwAF
z20YN4^`@TdNE$r3b;>N{q>14S1kPzCH4!P%U-d>wk+|rS<S&GHiq3fs)rh+6J|p0k
suOL@BSK-0o0j_sL8v*y5G_tcqTLjzVfM`k>GE;Bfy4wPPh)K6^ehZUC2><{9

literal 0
HcmV?d00001