From 16553c82806e0a55508baf553cb79e902638c10f Mon Sep 17 00:00:00 2001 From: Stefano Brivio Date: Tue, 18 Feb 2025 09:42:28 +0100 Subject: dhcp: Add option code byte in calculation for OPT_MAX boundary check Otherwise we'll limit messages to 577 bytes, instead of 576 bytes as intended: $ fqdn="thirtytwocharactersforeachlabel.thirtytwocharactersforeachlabel.thirtytwocharactersforeachlabel.thirtytwocharactersforeachlabel.thirtytwocharactersforeachlabel.thirtytwocharactersforeachlabel.thirtytwocharactersforeachlabel.then_make_it_251_with_this" $ hostname="__eighteen_bytes__" $ ./pasta --fqdn ${fqdn} -H ${hostname} -p dhcp.pcap -- /sbin/dhclient -4 Saving packet capture to dhcp.pcap $ tshark -r dhcp.pcap -V -Y 'dhcp.option.value == 5' | grep "Total Length" Total Length: 577 This was hidden by the issue fixed by commit bcc4908c2b4a ("dhcp Remove option 255 length byte") until now. Fixes: 31e8109a86ee ("dhcp, dhcpv6: Add hostname and client fqdn ops") Reviewed-by: David Gibson Reviewed-by: Enrique Llorente Signed-off-by: Stefano Brivio --- dhcp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/dhcp.c b/dhcp.c index 66a716e..b0de04b 100644 --- a/dhcp.c +++ b/dhcp.c @@ -143,7 +143,7 @@ static bool fill_one(struct msg *m, int o, int *offset) size_t slen = opts[o].slen; /* If we don't have space to write the option, then just skip */ - if (*offset + 1 /* length of option */ + slen > OPT_MAX) + if (*offset + 2 /* code and length of option */ + slen > OPT_MAX) return true; m->o[*offset] = o; -- cgit v1.2.3