[Dnsmasq-discuss] dnsmasq doesn't reply the last option of dhcpv6 relay-forward packet after applying the patch of CVE-2017-14494

yiwenchen yiwenchen at synology.com
Tue Feb 6 08:10:38 GMT 2018


Hi,


I found that dnsmasq doesn't reply dhcpv6 relay-forward packets after applying the patch of CVE-2017-14494.
It seems like the boundary check in the patch is wrong.

The following commit should fix the problem.
Could you please help confirm the issue?
Thank you very much.


---
src/rfc3315.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/rfc3315.c b/src/rfc3315.c
index c3c1c95..99b310a 100644
--- a/src/rfc3315.c
+++ b/src/rfc3315.c
@@ -216,7 +216,7 @@ static int dhcp6_maybe_relay(struct state *state, void *inbuff, size_t sz,

for (opt = opts; opt; opt = opt6_next(opt, end))
{
- if (opt6_ptr(opt, 0) + opt6_len(opt) >= end) {
+ if (opt6_ptr(opt, 0) + opt6_len(opt) > end) {
return 0;
}
int o = new_opt6(opt6_type(opt));
--
1.9.1

Best Regards,
Yiwen


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/attachments/20180206/47f0c6c2/attachment.html>


More information about the Dnsmasq-discuss mailing list