dhcp4: detect invalid length of address list on parsing (boo#918069)

openSUSE · Jul 1, 2015 · 3a77c6d · 3a77c6d
1 parent 187dcab
commit 3a77c6d
Showing 1 changed file with 5 additions and 0 deletions.
diff --git a/dhcp4/protocol.c b/dhcp4/protocol.c
@@ -1239,6 +1239,11 @@ ni_dhcp4_decode_csr(ni_buffer_t *bp, ni_route_array_t *routes)
 static int
 ni_dhcp4_decode_address_list(ni_buffer_t *bp, ni_string_array_t *list)
 {
+	if (ni_buffer_count(bp) % 4) {
+		bp->underflow = 1;
+		return -1;
+	}
+
 	while (ni_buffer_count(bp) && !bp->underflow) {
 		struct in_addr addr;