File dhcp-4.2.1-CVE-2011-2748_2749.diff of Package dhcp.import5685

Overview Repositories Revisions Requests Users Attributes Meta

File dhcp-4.2.1-CVE-2011-2748_2749.diff of Package dhcp.import5685

--- dhcp-4.2.1/common/discover.c
+++ dhcp-4.2.1/common/discover.c	2011/08/29 11:13:25
@@ -1386,12 +1386,16 @@ isc_result_t got_one (h)
 	if (result == 0)
 		return ISC_R_UNEXPECTED;
 
-	/* If we didn't at least get the fixed portion of the BOOTP
-	   packet, drop the packet.  We're allowing packets with no
-	   sname or filename, because we're aware of at least one
-	   client that sends such packets, but this definitely falls
-	   into the category of being forgiving. */
-	if (result < DHCP_FIXED_NON_UDP - DHCP_SNAME_LEN - DHCP_FILE_LEN)
+	/*
+	 * If we didn't at least get the fixed portion of the BOOTP
+	 * packet, drop the packet.
+	 * Previously we allowed packets with no sname or filename
+	 * as we were aware of at least one client that did.  But
+	 * a bug caused short packets to not work and nobody has
+	 * complained, it seems rational to tighten up that
+	 * restriction.
+	 */
+	if (result < DHCP_FIXED_NON_UDP)
 		return ISC_R_UNEXPECTED;
 
 	if (bootp_packet_handler) {
--- dhcp-4.2.1/common/options.c
+++ dhcp-4.2.1/common/options.c	2011/08/29 11:13:25
@@ -592,8 +592,8 @@ cons_options(struct packet *inpacket, st
 	} else if (bootpp) {
 		mb_size = 64;
 		if (inpacket != NULL &&
-		    (inpacket->packet_length - DHCP_FIXED_LEN >= 64))
-			mb_size = inpacket->packet_length - DHCP_FIXED_LEN;
+		    (inpacket->packet_length >= 64 + DHCP_FIXED_NON_UDP))
+			mb_size = inpacket->packet_length - DHCP_FIXED_NON_UDP;
 	} else
 		mb_size = DHCP_MIN_OPTION_LEN;
 
--- dhcp-4.2.1/server/dhcp.c
+++ dhcp-4.2.1/server/dhcp.c	2011/08/29 11:11:42
@@ -2336,6 +2336,7 @@ void ack_lease (packet, lease, offer, wh
 	 * giaddr.
 	 */
 	if (!packet->agent_options_stashed &&
+	    (packet->options != NULL) &&
 	    packet->options->universe_count > agent_universe.index &&
 	    packet->options->universes[agent_universe.index] != NULL) {
 	    oc = lookup_option (&server_universe, state -> options,
@@ -4429,6 +4430,7 @@ maybe_return_agent_options(struct packet
 	 * by the user into the new state, not just give up.
 	 */
 	if (!packet->agent_options_stashed &&
+	    (packet->options != NULL) &&
 	    packet->options->universe_count > agent_universe.index &&
 	    packet->options->universes[agent_universe.index] != NULL &&
 	    (options->universe_count <= agent_universe.index ||

Places

File dhcp-4.2.1-CVE-2011-2748_2749.diff of Package dhcp.import5685

Places