diff options
author | Antonio Quartulli <ordex@autistici.org> | 2012-02-27 05:29:53 -0500 |
---|---|---|
committer | Antonio Quartulli <ordex@autistici.org> | 2012-05-11 04:08:08 -0400 |
commit | 9205cc521ec74bd510857a464d4ac4edee949bfd (patch) | |
tree | ddc2e18bc62e0b8123df5c2ae956741e33222180 /net/batman-adv | |
parent | 06a4c1c55dbe5d9f7a708e8f1a52fd2ac8e5874f (diff) |
batman-adv: fix wrong dhcp option list browsing
In is_type_dhcprequest(), while parsing a DHCP message, if the entry we found in
the option list is neither a padding nor the dhcp-type, we have to ignore it and
jump as many bytes as its length + 1. The "+ 1" byte is given by the subtype
field itself that has to be jumped too.
Reported-by: Marek Lindner <lindner_marek@yahoo.de>
Signed-off-by: Antonio Quartulli <ordex@autistici.org>
Diffstat (limited to 'net/batman-adv')
-rw-r--r-- | net/batman-adv/gateway_client.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/net/batman-adv/gateway_client.c b/net/batman-adv/gateway_client.c index 6f9b9b78f77d..47f7186dcefc 100644 --- a/net/batman-adv/gateway_client.c +++ b/net/batman-adv/gateway_client.c | |||
@@ -558,10 +558,10 @@ static bool is_type_dhcprequest(struct sk_buff *skb, int header_len) | |||
558 | p++; | 558 | p++; |
559 | 559 | ||
560 | /* ...and then we jump over the data */ | 560 | /* ...and then we jump over the data */ |
561 | if (pkt_len < *p) | 561 | if (pkt_len < 1 + (*p)) |
562 | goto out; | 562 | goto out; |
563 | pkt_len -= *p; | 563 | pkt_len -= 1 + (*p); |
564 | p += (*p); | 564 | p += 1 + (*p); |
565 | } | 565 | } |
566 | } | 566 | } |
567 | out: | 567 | out: |