[PATCH v2 0/2] net: bootp: bound DHCP option parsing by the received packet length

[Pranav Rajendran <pranavkasthuri@gmail.com>]

Jerome pointed out on v1 that bounding dhcp_packet_process_options()
by the received length isn't enough on its own: dhcp_process_options()
itself reads the option-length byte and the option payload without
checking either is inside [popt, end), so a packet truncated right
after an option code byte (or with a length byte that overruns the
buffer) still walks off the end even with the outer bound fixed.

v2 adds a prerequisite patch (1/2) that closes that inner gap first,
then rebases the original outer-bound fix (2/2, unchanged from v1) on
top of it. With both applied, a short reply now stops parsing at the
first truncated option instead of reading past the receive buffer,
regardless of whether the truncation lands on the outer BOOTP_HDR_SIZE
boundary or inside an individual option.

Both patches are checkpatch --strict clean and build warning-free at
W=1 for net/bootp.o; a full sandbox build also succeeds.

Pranav Rajendran (2):
  net: bootp: validate DHCP option length before parsing it
  net: bootp: bound DHCP option parsing by the received packet length

 net/bootp.c | 42 +++++++++++++++++++++++++++++++-----------
 1 file changed, 31 insertions(+), 11 deletions(-)

-- 
2.50.1 (Apple Git-155)