diff options
| author | Kenneth R Westerback <krw@cvs.openbsd.org> | 2013-01-05 13:41:57 +0000 |
|---|---|---|
| committer | Kenneth R Westerback <krw@cvs.openbsd.org> | 2013-01-05 13:41:57 +0000 |
| commit | 0ebf97f9fb328ee7f28de68373e1e7fa0aa41b66 (patch) | |
| tree | 17457a60da9cdaff6092400f97c43439fc58d79a /sbin | |
| parent | 3f475455abd41e59bad43535e442a32b390619eb (diff) | |
Apply same fix to UDP length check as was just committed in dhcpd.
Diffstat (limited to 'sbin')
| -rw-r--r-- | sbin/dhclient/packet.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/sbin/dhclient/packet.c b/sbin/dhclient/packet.c index 8b597dac54f..5ac0c55b5b2 100644 --- a/sbin/dhclient/packet.c +++ b/sbin/dhclient/packet.c @@ -1,4 +1,4 @@ -/* $OpenBSD: packet.c,v 1.14 2012/11/15 14:54:18 krw Exp $ */ +/* $OpenBSD: packet.c,v 1.15 2013/01/05 13:41:56 krw Exp $ */ /* Packet assembly code, originally contributed by Archie Cobbs. */ @@ -205,7 +205,7 @@ decode_udp_ip_header(unsigned char *buf, int bufix, struct sockaddr_in *from, data = buf + bufix + ip_len + sizeof(*udp); len = ntohs(udp->uh_ulen) - sizeof(*udp); udp_packets_length_checked++; - if (len + data > buf + bufix + buflen) { + if ((len < 0) || (len + data > buf + bufix + buflen)) { udp_packets_length_overflow++; if (udp_packets_length_checked > 4 && (udp_packets_length_checked / |