summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authortintin2017-10-13 13:11:48 -0500
committerandroid-build-team Robot2017-11-27 21:33:09 -0600
commitb71335264a7c3629f80b7bf1f87375c75c42d868 (patch)
treef0b9026cb10d9d270231e647c78988abfe516537
parentf469ebae8604bc756259c7305f8cb7617ca18ddc (diff)
downloadplatform-system-core-b71335264a7c3629f80b7bf1f87375c75c42d868.tar.gz
platform-system-core-b71335264a7c3629f80b7bf1f87375c75c42d868.tar.xz
platform-system-core-b71335264a7c3629f80b7bf1f87375c75c42d868.zip
libnetutil: Check dhcp respose packet length
Bug: 67474440 Test: Manual Change-Id: I84b533f0101a56ec01e64c7591f3c7e82f513b2e Signed-off-by: Dmitry Shmidt <dimitrysh@google.com> (cherry picked from commit 61f25d4a3657e79659963d12005afa8c30883015)
-rw-r--r--libnetutils/packet.c14
1 files changed, 14 insertions, 0 deletions
diff --git a/libnetutils/packet.c b/libnetutils/packet.c
index e53a4c84f..9ecdd4f4e 100644
--- a/libnetutils/packet.c
+++ b/libnetutils/packet.c
@@ -218,6 +218,20 @@ int receive_packet(int s, struct dhcp_msg *msg)
218 * to construct the pseudo header used in the checksum calculation. 218 * to construct the pseudo header used in the checksum calculation.
219 */ 219 */
220 dhcp_size = ntohs(packet.udp.len) - sizeof(packet.udp); 220 dhcp_size = ntohs(packet.udp.len) - sizeof(packet.udp);
221 /*
222 * check validity of dhcp_size.
223 * 1) cannot be negative or zero.
224 * 2) src buffer contains enough bytes to copy
225 * 3) cannot exceed destination buffer
226 */
227 if ((dhcp_size <= 0) ||
228 ((int)(nread - sizeof(struct iphdr) - sizeof(struct udphdr)) < dhcp_size) ||
229 ((int)sizeof(struct dhcp_msg) < dhcp_size)) {
230#if VERBOSE
231 ALOGD("Malformed Packet");
232#endif
233 return -1;
234 }
221 saddr = packet.ip.saddr; 235 saddr = packet.ip.saddr;
222 daddr = packet.ip.daddr; 236 daddr = packet.ip.daddr;
223 nread = ntohs(packet.ip.tot_len); 237 nread = ntohs(packet.ip.tot_len);