commit 3dd9a4fc08fc2fb7e7ce23e3dd6a4da51f09c3b5
author tintin <tintinweb@oststrom.com> Thu Nov 02 03:05:45 2017 +0000
committer android-build-merger <android-build-merger@google.com> Thu Nov 02 03:05:45 2017 +0000
tree f425624d55d0644f072846241805e3e944690641
parent 8c1753dea60dc66b1f4a758b238744b1082fefa5
parent 6f62061a0635e6e146b9aef2f8ee25d9bca6b775

libnetutil: Check dhcp respose packet length am: 61f25d4a36 am: cee6d38c55
am: 29d054046f

Change-Id: Ic15afbd822f6901e6db9274304af3e587fa8ce08

libnetutils/packet.c

diff --git a/libnetutils/packet.c b/libnetutils/packet.c
index cd26d05..bfc5f4d 100644
--- a/libnetutils/packet.c
+++ b/libnetutils/packet.c
@@ -219,6 +219,20 @@
      * to construct the pseudo header used in the checksum calculation.
      */
     dhcp_size = ntohs(packet.udp.len) - sizeof(packet.udp);
+    /*
+     * check validity of dhcp_size.
+     * 1) cannot be negative or zero.
+     * 2) src buffer contains enough bytes to copy
+     * 3) cannot exceed destination buffer
+     */
+    if ((dhcp_size <= 0) ||
+        ((int)(nread - sizeof(struct iphdr) - sizeof(struct udphdr)) < dhcp_size) ||
+        ((int)sizeof(struct dhcp_msg) < dhcp_size)) {
+#if VERBOSE
+        ALOGD("Malformed Packet");
+#endif
+        return -1;
+    }
     saddr = packet.ip.saddr;
     daddr = packet.ip.daddr;
     nread = ntohs(packet.ip.tot_len);