[PATCH] net: dhcp6: Fix OPT_BOOTFILE_PARAM parsing

[PATCH] net: dhcp6: Fix OPT_BOOTFILE_PARAM parsing

[seanedmond]

From: Sean Edmond <seanedmond@microsoft.com>

RFC 5970 states that OPT_BOOTFILE_PARAM (option 60) can be
multiple parameters that start with a 16-bit length field followed
by the parameter. For example:
[ param-len 1 (16-bits) ] [ parameter 1 (variable length) ]

This fix ensure we're considering "param-len 1" in the parsing.

Signed-off-by: Sean Edmond <seanedmond@microsoft.com>
---
 net/dhcpv6.c | 15 ++++++++++++---
 1 file changed, 12 insertions(+), 3 deletions(-)

diff --git a/net/dhcpv6.c b/net/dhcpv6.c
index 73a1067877..4aea779f6f 100644
--- a/net/dhcpv6.c
+++ b/net/dhcpv6.c
@@ -304,7 +304,7 @@ static void dhcp6_parse_ia_options(struct dhcp6_option_hdr *ia_ptr, uchar *ia_op
 static void dhcp6_parse_options(uchar *rx_pkt, unsigned int len)
 {
 	uchar *option_ptr;
-	int sol_max_rt_sec, option_len;
+	int sol_max_rt_sec, option_len, param_len_1;
 	char *s, *e;
 	struct dhcp6_option_hdr *option_hdr;
 
@@ -390,14 +390,23 @@ static void dhcp6_parse_options(uchar *rx_pkt, unsigned int len)
 		case DHCP6_OPTION_OPT_BOOTFILE_PARAM:
 			if (IS_ENABLED(CONFIG_DHCP6_PXE_DHCP_OPTION)) {
 				debug("DHCP6_OPTION_OPT_BOOTFILE_PARAM FOUND\n");
+				/* if CONFIG_DHCP6_PXE_DHCP_OPTION is set the PXE config file path
+				 * is contained in the first OPT_BOOTFILE_PARAM argument
+				 */
+				param_len_1 = ntohs(*((u16 *)option_ptr));
+				option_ptr += sizeof(u16);
+				if (param_len_1 + sizeof(u16) > option_len) {
+					debug("Invalid BOOTFILE_PARAM param_len_1. Skipping\n");
+					break;
+				}
 
 				if (pxelinux_configfile)
 					free(pxelinux_configfile);
 
-				pxelinux_configfile = (char *)malloc((option_len + 1) *
+				pxelinux_configfile = (char *)malloc((param_len_1 + 1) *
 						      sizeof(char));
 				if (pxelinux_configfile)
-					strlcpy(pxelinux_configfile, option_ptr, option_len + 1);
+					strlcpy(pxelinux_configfile, option_ptr, param_len_1 + 1);
 				else
 					printf("Error: Failed to allocate pxelinux_configfile\n");
 
-- 
2.40.0

Re: [PATCH] net: dhcp6: Fix OPT_BOOTFILE_PARAM parsing

[Tom Rini]

[-- Attachment #1: Type: text/plain, Size: 545 bytes --]

On Tue, Jul 25, 2023 at 04:13:29PM -0700, seanedmond@linux.microsoft.com wrote:

> From: Sean Edmond <seanedmond@microsoft.com>
> 
> RFC 5970 states that OPT_BOOTFILE_PARAM (option 60) can be
> multiple parameters that start with a 16-bit length field followed
> by the parameter. For example:
> [ param-len 1 (16-bits) ] [ parameter 1 (variable length) ]
> 
> This fix ensure we're considering "param-len 1" in the parsing.
> 
> Signed-off-by: Sean Edmond <seanedmond@microsoft.com>

Applied to u-boot/master, thanks!

-- 
Tom

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 659 bytes --]