Skip to content

Commit

Permalink
MFC r342227: bootpd: validate hardware type
Browse files Browse the repository at this point in the history
Due to insufficient validation of network-provided data it may have been
possible for a malicious actor to craft a bootp packet which could cause
a stack buffer overflow.

admbugs:	850
Reported by:	Reno Robert
Reviewed by:	markj
Approved by:	so
Security:	FreeBSD-SA-18:15.bootpd
Sponsored by:	The FreeBSD Foundation
  • Loading branch information
emaste committed Dec 19, 2018
1 parent 82cb757 commit cc913fb
Showing 1 changed file with 4 additions and 0 deletions.
4 changes: 4 additions & 0 deletions libexec/bootpd/bootpd.c
Expand Up @@ -636,6 +636,10 @@ handle_request()
char *homedir, *bootfile;
int n;

if (bp->bp_htype >= hwinfocnt) {
report(LOG_NOTICE, "bad hw addr type %u", bp->bp_htype);
return;
}
bp->bp_file[sizeof(bp->bp_file)-1] = '\0';

/* XXX - SLIP init: Set bp_ciaddr = recv_addr here? */
Expand Down

0 comments on commit cc913fb

Please sign in to comment.