udhcpc: check read of overload option data byte to be within packet
function old new delta
udhcp_get_option 220 225 +5
Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
diff --git a/networking/udhcp/common.c b/networking/udhcp/common.c
index 589bcd6..1aaf525 100644
--- a/networking/udhcp/common.c
+++ b/networking/udhcp/common.c
@@ -268,7 +268,8 @@
}
if (optionptr[OPT_CODE] == DHCP_OPTION_OVERLOAD) {
- overload |= optionptr[OPT_DATA];
+ if (len >= 3)
+ overload |= optionptr[OPT_DATA];
/* fall through */
}
optionptr += len;