diff options
| author | Sean Edmond | 2023-05-18 12:35:40 -0700 |
|---|---|---|
| committer | Tom Rini | 2023-06-14 15:48:45 -0400 |
| commit | 1b3117db3ecdb0ec281899a00c8662b22059c01b (patch) | |
| tree | 12d5705a179a1bf74ca78d0a31847332660c33f3 | |
| parent | 70ca9f62f3ac3cb67be696815e8be8600623795f (diff) | |
net: ipv6: Fix CID 453851 and CID 436278
CID 453851 : sprintf() shouldn't copy from/to tmp
CID 436278 : DHCP6 option_len should be checked before use
Signed-off-by: Sean Edmond <seanedmond@microsoft.com>
Reviewed-by: Ramon Fried <rfried.dev@gmail.com>
| -rw-r--r-- | cmd/net.c | 12 | ||||
| -rw-r--r-- | net/dhcpv6.c | 5 |
2 files changed, 11 insertions, 6 deletions
diff --git a/cmd/net.c b/cmd/net.c index 68d406291ef..9e1f40a56e9 100644 --- a/cmd/net.c +++ b/cmd/net.c @@ -209,7 +209,7 @@ U_BOOT_CMD( static void netboot_update_env(void) { - char tmp[44]; + char tmp[46]; if (net_gateway.s_addr) { ip_to_string(net_gateway, tmp); @@ -274,20 +274,20 @@ static void netboot_update_env(void) if (IS_ENABLED(CONFIG_IPV6)) { if (!ip6_is_unspecified_addr(&net_ip6) || net_prefix_length != 0) { - sprintf(tmp, "%pI6c", &net_ip6); if (net_prefix_length != 0) - sprintf(tmp, "%s/%d", tmp, net_prefix_length); - + snprintf(tmp, sizeof(tmp), "%pI6c/%d", &net_ip6, net_prefix_length); + else + snprintf(tmp, sizeof(tmp), "%pI6c", &net_ip6); env_set("ip6addr", tmp); } if (!ip6_is_unspecified_addr(&net_server_ip6)) { - sprintf(tmp, "%pI6c", &net_server_ip6); + snprintf(tmp, sizeof(tmp), "%pI6c", &net_server_ip6); env_set("serverip6", tmp); } if (!ip6_is_unspecified_addr(&net_gateway6)) { - sprintf(tmp, "%pI6c", &net_gateway6); + snprintf(tmp, sizeof(tmp), "%pI6c", &net_gateway6); env_set("gatewayip6", tmp); } } diff --git a/net/dhcpv6.c b/net/dhcpv6.c index 0d1c600632f..73a1067877c 100644 --- a/net/dhcpv6.c +++ b/net/dhcpv6.c @@ -316,6 +316,11 @@ static void dhcp6_parse_options(uchar *rx_pkt, unsigned int len) option_ptr = ((uchar *)option_hdr) + sizeof(struct dhcp6_hdr); option_len = ntohs(option_hdr->option_len); + if (option_ptr + option_len > rx_pkt + len) { + debug("Invalid option length\n"); + return; + } + switch (ntohs(option_hdr->option_id)) { case DHCP6_OPTION_CLIENTID: if (memcmp(option_ptr, sm_params.duid, option_len) |