[PATCH] net: ipv4: ipconfig: fix OOB read in DHCP option parsing

[Liu Chao <liuc63@xiaopeng.com>]

The DHCP option parser in ic_bootp_recv() advances the option
pointer by the option length and only checks that the new pointer
has not reached the end of the packet.  The length byte and the
option payload (opt[1], opt[2]) are then read without verifying
that they lie within the buffer, so a malformed reply from a
rogue DHCP server can trigger an out-of-bounds read.

Validate the option length against the remaining bytes before
consuming the option, and skip options that do not fit.  This
keeps the existing parsing logic intact while ensuring all reads
stay within the received packet.

Reviewed-by: Guanglei Zhu <zhugl3@xiaopeng.com>
Signed-off-by: Liu Chao <liuc63@xiaopeng.com>
---
 net/ipv4/ipconfig.c | 38 ++++++++++++++++++++------------------
 1 file changed, 20 insertions(+), 18 deletions(-)

diff --git a/net/ipv4/ipconfig.c b/net/ipv4/ipconfig.c
index 22a788987..0b39a5ccf 100644
--- a/net/ipv4/ipconfig.c
+++ b/net/ipv4/ipconfig.c
@@ -1081,25 +1081,27 @@ static int __init ic_bootp_recv(struct sk_buff *skb, struct net_device *dev, str
 			__be32 server_id = NONE;
 			int mt = 0;
 
-			ext = &b->exten[4];
-			while (ext < end && *ext != 0xff) {
-				u8 *opt = ext++;
-				if (*opt == 0)	/* Padding */
-					continue;
-				ext += *ext + 1;
-				if (ext >= end)
-					break;
-				switch (*opt) {
-				case 53:	/* Message type */
-					if (opt[1])
-						mt = opt[2];
-					break;
-				case 54:	/* Server ID (IP address) */
-					if (opt[1] >= 4)
-						memcpy(&server_id, opt + 2, 4);
-					break;
+				ext = &b->exten[4];
+				while (ext < end && *ext != 0xff) {
+					u8 *opt = ext++;
+					if (*opt == 0)	/* Padding */
+						continue;
+					if (ext >= end)
+						break;
+					ext += *ext + 1;
+					if (ext > end)
+						break;
+					switch (*opt) {
+					case 53:	/* Message type */
+						if (opt[1])
+							mt = opt[2];
+						break;
+					case 54:	/* Server ID (IP address) */
+						if (opt[1] >= 4)
+							memcpy(&server_id, opt + 2, 4);
+						break;
+					}
 				}
-			}
 
 			pr_debug("DHCP: Got message type %d (%s)\n", mt, d->dev->name);
 
-- 
2.50.1