diff options
| author | orbisai0security <[email protected]> | 2026-05-07 05:37:15 +0000 |
|---|---|---|
| committer | Rbb666 <[email protected]> | 2026-05-25 10:15:11 +0800 |
| commit | 49f985e0f6a3fd33279e255a729e51dd2a4a3d34 (patch) | |
| tree | bce97809ffbce5b5a333c81f4473d9b0b734596b | |
| parent | 479acdb47ef7fe8b0658a3f6a35fcbbf55a68e0a (diff) | |
fix: V-001 security vulnerability
Automated security fix generated by Orbis Security AI
| -rw-r--r-- | components/net/lwip-dhcpd/dhcp_server_raw.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/components/net/lwip-dhcpd/dhcp_server_raw.c b/components/net/lwip-dhcpd/dhcp_server_raw.c index 9098cbbc91..47b990aea2 100644 --- a/components/net/lwip-dhcpd/dhcp_server_raw.c +++ b/components/net/lwip-dhcpd/dhcp_server_raw.c @@ -266,7 +266,7 @@ dhcp_alloc_again: { return NULL; } - SMEMCPY(node->chaddr, msg->chaddr, msg->hlen); + SMEMCPY(node->chaddr, msg->chaddr, (msg->hlen > sizeof(node->chaddr)) ? sizeof(node->chaddr) : msg->hlen); node->ipaddr = dhcpserver->current; node->next = dhcpserver->node_list; @@ -731,10 +731,10 @@ void dhcpd_start(const char *netif_name) } p = p + 1; /* move to xxx.xxx.xxx.^ */ - sprintf(p, "%d", DHCPD_CLIENT_IP_MIN); + snprintf(p, (size_t)(str_tmp + sizeof(str_tmp) - p), "%d", DHCPD_CLIENT_IP_MIN); ip4addr_aton(str_tmp, &ip_start); DEBUG_PRINTF("ip_start: [%s]\r\n", str_tmp); - sprintf(p, "%d", DHCPD_CLIENT_IP_MAX); + snprintf(p, (size_t)(str_tmp + sizeof(str_tmp) - p), "%d", DHCPD_CLIENT_IP_MAX); ip4addr_aton(str_tmp, &ip_end); DEBUG_PRINTF("ip_end: [%s]\r\n", str_tmp); |