[components][lwip] dhcpd: check buffer bounds when parsing options

The option loop advanced by the option length without checking the
number of bytes actually received by recvfrom(), so a malformed or
truncated DHCP packet could make the server read past the end of the
receive buffer.

Check that the option type, length and payload stay inside the received
data before reading them, and stop parsing when a requested IP option
is shorter than 4 bytes or a message type option is shorter than 1 byte.

Fixes #11323

0 files changed, 0 insertions, 0 deletions