Skip to content

Commit 9070493

Browse files
nrabulinskislp
authored andcommitted
Return early from parsing DHCP response if End is encoutered
Up until now DHCP response was parsed by reading the option and the length first. The length field obviously does not apply to the End option, so if muvm got a response that ended exactly at the End byte, muvm would crash because of an out-of-bound read. Signed-off-by: Nikodem Rabuliński <[email protected]>
1 parent 58a3e08 commit 9070493

1 file changed

Lines changed: 6 additions & 3 deletions

File tree

crates/muvm/src/guest/net.rs

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -171,6 +171,12 @@ fn do_dhcp(rtnl: &NlRouter) -> Result<()> {
171171

172172
while p < len {
173173
let o = msg[p];
174+
175+
if o == 0xff {
176+
// Option 255: End (of options)
177+
break;
178+
}
179+
174180
let l: u8 = msg[p + 1];
175181
p += 2; // Length doesn't include code and length field itself
176182

@@ -195,9 +201,6 @@ fn do_dhcp(rtnl: &NlRouter) -> Result<()> {
195201

196202
// We don't know yet if IPv6 is available: don't go below 1280 B
197203
mtu = mtu.clamp(1280, 65520);
198-
} else if o == 0xff {
199-
// Option 255: End (of options)
200-
break;
201204
}
202205

203206
p += l as usize;

0 commit comments

Comments
 (0)