File 0251-libslirp-dhcp-Always-send-DHCP_OPT_.patch of Package qemu.20749

Overview Repositories Revisions Requests Users Attributes Meta

File 0251-libslirp-dhcp-Always-send-DHCP_OPT_.patch of Package qemu.20749

From: Jose R Ziviani <jose.ziviani@suse.com>
Date: Tue, 6 Jul 2021 20:06:16 -0600
Subject: libslirp: dhcp: Always send DHCP_OPT_LEN bytes in options

Git-commit: d7fb54218424c3b2517aee5b391ced0f75386a5d
References: bsc#1187364, CVE-2021-3592

RFC2131 suggests that the options field may be at least 312 bytes.
Some DHCP clients seem to assume that it has to be at least 312 bytes.

Fixes #51
Fixes: f13cad45b25d92760bb0ad67bec0300a4d7d5275 ("bootp: limit
vendor-specific area to input packet memory buffer")

Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
Signed-off-by: Jose R Ziviani <jose.ziviani@suse.com>
---
 slirp/bootp.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/slirp/bootp.c b/slirp/bootp.c
index 41630e148deeb835233d32fca47d..11a9b6421a0fa3bae9c8a05688b0 100644
--- a/slirp/bootp.c
+++ b/slirp/bootp.c
@@ -333,12 +333,13 @@ static void bootp_reply(Slirp *slirp,
         q += sizeof(nak_msg) - 1;
     }
     assert(q < end);
-    *q = RFC1533_END;
+    *q++ = RFC1533_END;
 
     daddr.sin_addr.s_addr = 0xffffffffu;
 
-    m->m_len = sizeof(struct bootp_t) -
-        sizeof(struct ip) - sizeof(struct udphdr);
+    assert(q <= end);
+
+    m->m_len = sizeof(struct bootp_t) + (end - rbp->bp_vend) - sizeof(struct ip) - sizeof(struct udphdr);
     udp_output(NULL, m, &saddr, &daddr, IPTOS_LOWDELAY);
 }

Places

File 0251-libslirp-dhcp-Always-send-DHCP_OPT_.patch of Package qemu.20749

Places