udhcpd: mangle hostnames starting with dash ("-option")
function old new delta
add_lease 316 328 +12
Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
diff --git a/networking/udhcp/dhcpd.c b/networking/udhcp/dhcpd.c
index 3e08ec0..9d66049 100644
--- a/networking/udhcp/dhcpd.c
+++ b/networking/udhcp/dhcpd.c
@@ -192,6 +192,8 @@
* but merely make dumpleases output safe for shells to use.
* We accept "0-9A-Za-z._-", all other chars turn to dots.
*/
+ if (*p == '-')
+ *p = '.'; /* defeat "-option" attacks too */
while (*p) {
if (!isalnum(*p) && *p != '-' && *p != '_')
*p = '.';
