From 1b3117db3ecdb0ec281899a00c8662b22059c01b Mon Sep 17 00:00:00 2001 From: Sean Edmond Date: Thu, 18 May 2023 12:35:40 -0700 Subject: net: ipv6: Fix CID 453851 and CID 436278 CID 453851 : sprintf() shouldn't copy from/to tmp CID 436278 : DHCP6 option_len should be checked before use Signed-off-by: Sean Edmond Reviewed-by: Ramon Fried --- net/dhcpv6.c | 5 +++++ 1 file changed, 5 insertions(+) (limited to 'net') diff --git a/net/dhcpv6.c b/net/dhcpv6.c index 0d1c600632f..73a1067877c 100644 --- a/net/dhcpv6.c +++ b/net/dhcpv6.c @@ -316,6 +316,11 @@ static void dhcp6_parse_options(uchar *rx_pkt, unsigned int len) option_ptr = ((uchar *)option_hdr) + sizeof(struct dhcp6_hdr); option_len = ntohs(option_hdr->option_len); + if (option_ptr + option_len > rx_pkt + len) { + debug("Invalid option length\n"); + return; + } + switch (ntohs(option_hdr->option_id)) { case DHCP6_OPTION_CLIENTID: if (memcmp(option_ptr, sm_params.duid, option_len) -- cgit v1.3.1 From 2f7c7159ea4c0e5c2aa7671c5b5a2889d0abe7ce Mon Sep 17 00:00:00 2001 From: Sean Edmond Date: Thu, 18 May 2023 12:35:41 -0700 Subject: net: dhcp6: Fix VCI string Change VCI string from "U-boot" to "U-Boot". Signed-off-by: Sean Edmond Reviewed-by: Ramon Fried --- net/dhcpv6.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'net') diff --git a/net/dhcpv6.h b/net/dhcpv6.h index 80ca5204325..65c8e4c71d3 100644 --- a/net/dhcpv6.h +++ b/net/dhcpv6.h @@ -38,7 +38,7 @@ #define DUID_MAX_SIZE DUID_LL_SIZE /* only supports DUID-LL currently */ /* vendor-class-data to send in vendor clas option */ -#define DHCP6_VCI_STRING "U-boot" +#define DHCP6_VCI_STRING "U-Boot" #define DHCP6_MULTICAST_ADDR "ff02::1:2" /* DHCP multicast address */ -- cgit v1.3.1