Browse Source

Apply patch from Kudratov Olimjon: Array index used before limits check

while ((q != NULL) && (options[offset] != DHCP_OPTION_END) && (offset < offset_max)) {
should be
while ((q != NULL) && (offset < offset_max) && (options[offset] != DHCP_OPTION_END)) {

See https://jira.reactos.org/browse/CORE-8978 for more info.
(cherry picked from commit 32aa9a41e2013e5ee6eee09317a848647e37badf)
Dirk Ziegelmeier 8 năm trước cách đây
mục cha
commit
dced7dad41
1 tập tin đã thay đổi với 1 bổ sung1 xóa
  1. 1 1
      src/core/ipv4/dhcp.c

+ 1 - 1
src/core/ipv4/dhcp.c

@@ -1500,7 +1500,7 @@ again:
   offset_max = options_idx_max;
   options = (u8_t*)q->payload;
   /* at least 1 byte to read and no end marker, then at least 3 bytes to read? */
-  while ((q != NULL) && (options[offset] != DHCP_OPTION_END) && (offset < offset_max)) {
+  while ((q != NULL) && (offset < offset_max) && (options[offset] != DHCP_OPTION_END)) {
     u8_t op = options[offset];
     u8_t len;
     u8_t decode_len = 0;