batman-adv: fix wrong dhcp option list browsing
In is_type_dhcprequest(), while parsing a DHCP message, if the entry we found in the option list is neither a padding nor the dhcp-type, we have to ignore it and jump as many bytes as its length + 1. The "+ 1" byte is given by the subtype field itself that has to be jumped too. Reported-by: Marek Lindner <lindner_marek@yahoo.de> Signed-off-by: Antonio Quartulli <ordex@autistici.org>
This commit is contained in:
parent
06a4c1c55d
commit
9205cc521e
|
@ -558,10 +558,10 @@ static bool is_type_dhcprequest(struct sk_buff *skb, int header_len)
|
|||
p++;
|
||||
|
||||
/* ...and then we jump over the data */
|
||||
if (pkt_len < *p)
|
||||
if (pkt_len < 1 + (*p))
|
||||
goto out;
|
||||
pkt_len -= *p;
|
||||
p += (*p);
|
||||
pkt_len -= 1 + (*p);
|
||||
p += 1 + (*p);
|
||||
}
|
||||
}
|
||||
out:
|
||||
|
|
Loading…
Reference in a new issue