While parsing dhcp options string in 'dhcp_decode', if an options' length 'len' appeared towards the end of 'bp_vend' array, ensuing read could lead to an OOB memory access issue. Add check to avoid it. Reported-by: Reno Robert
Signed-off-by: Prasad J Pandit --- slirp/bootp.c | 3 +++ 1 file changed, 3 insertions(+) Index: xen-4.9.0-testing/tools/qemu-xen-traditional-dir-remote/slirp/bootp.c =================================================================== --- xen-4.9.0-testing.orig/tools/qemu-xen-traditional-dir-remote/slirp/bootp.c +++ xen-4.9.0-testing/tools/qemu-xen-traditional-dir-remote/slirp/bootp.c @@ -109,6 +109,9 @@ static void dhcp_decode(const uint8_t *b if (p >= p_end) break; len = *p++; + if (p + len > p_end) { + break; + } dprintf("dhcp: tag=0x%02x len=%d\n", tag, len); switch(tag) {