Difuse/u-boot
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

net: ipv6: Fix CID 453851 and CID 436278

Browse source 
CID 453851 : sprintf() shouldn't copy from/to tmp
CID 436278 : DHCP6 option_len should be checked before use

Signed-off-by: Sean Edmond <seanedmond@microsoft.com>
Reviewed-by: Ramon Fried <rfried.dev@gmail.com>
This commit is contained in:
Sean Edmond 2023-05-18 12:35:40 -07:00 committed by Tom Rini
parent 70ca9f62f3
commit 1b3117db3e
2 changed files with 11 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

12
cmd/net.c
View file

@ -209,7 +209,7 @@ U_BOOT_CMD(
static void netboot_update_env(void) static void netboot_update_env(void)
{ {
char tmp[44]; char tmp[46];
if (net_gateway.s_addr) { if (net_gateway.s_addr) {
ip_to_string(net_gateway, tmp); ip_to_string(net_gateway, tmp);
@ -274,20 +274,20 @@ static void netboot_update_env(void)
if (IS_ENABLED(CONFIG_IPV6)) { if (IS_ENABLED(CONFIG_IPV6)) {
if (!ip6_is_unspecified_addr(&net_ip6) || if (!ip6_is_unspecified_addr(&net_ip6) ||
net_prefix_length != 0) { net_prefix_length != 0) {
sprintf(tmp, "%pI6c", &net_ip6);
if (net_prefix_length != 0) if (net_prefix_length != 0)
sprintf(tmp, "%s/%d", tmp, net_prefix_length); snprintf(tmp, sizeof(tmp), "%pI6c/%d", &net_ip6, net_prefix_length);
else
snprintf(tmp, sizeof(tmp), "%pI6c", &net_ip6);
env_set("ip6addr", tmp); env_set("ip6addr", tmp);
} }
if (!ip6_is_unspecified_addr(&net_server_ip6)) { if (!ip6_is_unspecified_addr(&net_server_ip6)) {
sprintf(tmp, "%pI6c", &net_server_ip6); snprintf(tmp, sizeof(tmp), "%pI6c", &net_server_ip6);
env_set("serverip6", tmp); env_set("serverip6", tmp);
} }
if (!ip6_is_unspecified_addr(&net_gateway6)) { if (!ip6_is_unspecified_addr(&net_gateway6)) {
sprintf(tmp, "%pI6c", &net_gateway6); snprintf(tmp, sizeof(tmp), "%pI6c", &net_gateway6);
env_set("gatewayip6", tmp); env_set("gatewayip6", tmp);
} }
} }

5
net/dhcpv6.c
View file

@ -316,6 +316,11 @@ static void dhcp6_parse_options(uchar *rx_pkt, unsigned int len)
option_ptr = ((uchar *)option_hdr) + sizeof(struct dhcp6_hdr); option_ptr = ((uchar *)option_hdr) + sizeof(struct dhcp6_hdr);
option_len = ntohs(option_hdr->option_len); option_len = ntohs(option_hdr->option_len);
if (option_ptr + option_len > rx_pkt + len) {
debug("Invalid option length\n");
return;
}
switch (ntohs(option_hdr->option_id)) { switch (ntohs(option_hdr->option_id)) {
case DHCP6_OPTION_CLIENTID: case DHCP6_OPTION_CLIENTID:
if (memcmp(option_ptr, sm_params.duid, option_len) if (memcmp(option_ptr, sm_params.duid, option_len)