commit d60dc7ef5c306e57ac345476b5f3a1e474d18f5b
author tintin <tintinweb@oststrom.com> Thu Nov 02 03:28:42 2017 +0000
committer android-build-merger <android-build-merger@google.com> Thu Nov 02 03:28:42 2017 +0000
tree f0b9026cb10d9d270231e647c78988abfe516537
parent fdd67a54ec43b47616893f8138d6d7029d14513b
parent 9f1398c6e33a5012f997a3624394e4b64c2092ad

libnetutil: Check dhcp respose packet length am: 61f25d4a36 am: cee6d38c55 am: 29d054046f am: c29049f4f8 am: 3de04e9840 am: 19702dc499 am: 8191e9ba87 am: 804323c195 am: 4f5f00d879 am: 3a1ff1ad71 am: bab7b1ecd9 am: cdf0fc6018
am: 9f1398c6e3

Change-Id: I4c46a36846dd8f6588f29bc84de9bc3f1d7c088a

libnetutils/packet.c

diff --git a/libnetutils/packet.c b/libnetutils/packet.c
index e53a4c8..9ecdd4f 100644
--- a/libnetutils/packet.c
+++ b/libnetutils/packet.c
@@ -218,6 +218,20 @@
      * to construct the pseudo header used in the checksum calculation.
      */
     dhcp_size = ntohs(packet.udp.len) - sizeof(packet.udp);
+    /*
+     * check validity of dhcp_size.
+     * 1) cannot be negative or zero.
+     * 2) src buffer contains enough bytes to copy
+     * 3) cannot exceed destination buffer
+     */
+    if ((dhcp_size <= 0) ||
+        ((int)(nread - sizeof(struct iphdr) - sizeof(struct udphdr)) < dhcp_size) ||
+        ((int)sizeof(struct dhcp_msg) < dhcp_size)) {
+#if VERBOSE
+        ALOGD("Malformed Packet");
+#endif
+        return -1;
+    }
     saddr = packet.ip.saddr;
     daddr = packet.ip.daddr;
     nread = ntohs(packet.ip.tot_len);