From de98024485397755232212ff862ffb2a2ca4f08f Mon Sep 17 00:00:00 2001 From: tintin Date: Fri, 13 Oct 2017 11:11:48 -0700 Subject: libnetutil: Check dhcp respose packet length Bug: 67474440 Test: Manual Change-Id: I84b533f0101a56ec01e64c7591f3c7e82f513b2e Signed-off-by: Dmitry Shmidt (cherry picked from commit 61f25d4a3657e79659963d12005afa8c30883015) --- libnetutils/packet.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/libnetutils/packet.c b/libnetutils/packet.c index e53a4c84f..9ecdd4f4e 100644 --- a/libnetutils/packet.c +++ b/libnetutils/packet.c @@ -218,6 +218,20 @@ int receive_packet(int s, struct dhcp_msg *msg) * to construct the pseudo header used in the checksum calculation. */ dhcp_size = ntohs(packet.udp.len) - sizeof(packet.udp); + /* + * check validity of dhcp_size. + * 1) cannot be negative or zero. + * 2) src buffer contains enough bytes to copy + * 3) cannot exceed destination buffer + */ + if ((dhcp_size <= 0) || + ((int)(nread - sizeof(struct iphdr) - sizeof(struct udphdr)) < dhcp_size) || + ((int)sizeof(struct dhcp_msg) < dhcp_size)) { +#if VERBOSE + ALOGD("Malformed Packet"); +#endif + return -1; + } saddr = packet.ip.saddr; daddr = packet.ip.daddr; nread = ntohs(packet.ip.tot_len); -- cgit v1.2.3