commit 9fbba971ff0904419bb087fe1031b312911a87b8
author tintin <tintinweb@oststrom.com> Fri Oct 13 11:11:48 2017 -0700
committer Nikoli Cartagena <dargeren@google.com> Mon Nov 13 16:02:40 2017 -0800
tree d106ef9c694816fd5ef36c08235fba4f7a7f87f1
parent 11f60c504b452cecb58f27bb8fe22331b7599d1c

libnetutil: Check dhcp respose packet length

Bug: 67474440
Test: Manual

Change-Id: I84b533f0101a56ec01e64c7591f3c7e82f513b2e
Signed-off-by: Dmitry Shmidt <dimitrysh@google.com>
(cherry picked from commit 61f25d4a3657e79659963d12005afa8c30883015)

libnetutils/packet.c

diff --git a/libnetutils/packet.c b/libnetutils/packet.c
index cd26d05..bfc5f4d 100644
--- a/libnetutils/packet.c
+++ b/libnetutils/packet.c
@@ -219,6 +219,20 @@
      * to construct the pseudo header used in the checksum calculation.
      */
     dhcp_size = ntohs(packet.udp.len) - sizeof(packet.udp);
+    /*
+     * check validity of dhcp_size.
+     * 1) cannot be negative or zero.
+     * 2) src buffer contains enough bytes to copy
+     * 3) cannot exceed destination buffer
+     */
+    if ((dhcp_size <= 0) ||
+        ((int)(nread - sizeof(struct iphdr) - sizeof(struct udphdr)) < dhcp_size) ||
+        ((int)sizeof(struct dhcp_msg) < dhcp_size)) {
+#if VERBOSE
+        ALOGD("Malformed Packet");
+#endif
+        return -1;
+    }
     saddr = packet.ip.saddr;
     daddr = packet.ip.daddr;
     nread = ntohs(packet.ip.tot_len);