[src/trunk]: src/external/mpl/dhcp/dist/common If an option is not found in t...

[christos <christos%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/da4aacf364cb
branches:  trunk
changeset: 949414:da4aacf364cb
user:      christos <christos%NetBSD.org@localhost>
date:      Wed Jan 13 15:51:49 2021 +0000

description:
If an option is not found in the standard table, log it and don't try to
dereference it. This prevents crashes from XenServer VM that PXE boots and
includes option 175 in the DHCP request. Reported by Stephen Borrill.

diffstat:

 external/mpl/dhcp/dist/common/options.c |  19 ++++++++++++-------
 1 files changed, 12 insertions(+), 7 deletions(-)

diffs (58 lines):

diff -r fd6db417da1e -r da4aacf364cb external/mpl/dhcp/dist/common/options.c
--- a/external/mpl/dhcp/dist/common/options.c   Wed Jan 13 07:36:56 2021 +0000
+++ b/external/mpl/dhcp/dist/common/options.c   Wed Jan 13 15:51:49 2021 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: options.c,v 1.3 2020/08/03 21:10:56 christos Exp $     */
+/*     $NetBSD: options.c,v 1.4 2021/01/13 15:51:49 christos Exp $     */
 
 /* options.c
 
@@ -29,7 +29,7 @@
  */
 
 #include <sys/cdefs.h>
-__RCSID("$NetBSD: options.c,v 1.3 2020/08/03 21:10:56 christos Exp $");
+__RCSID("$NetBSD: options.c,v 1.4 2021/01/13 15:51:49 christos Exp $");
 
 #define DHCP_OPTION_DATA
 #include "dhcpd.h"
@@ -179,13 +179,16 @@
 
                offset += universe->length_size;
 
-               option_code_hash_lookup(&option, universe->code_hash, &code,
-                                       0, MDL);
+               if (!option_code_hash_lookup(&option, universe->code_hash,
+                   &code, 0, MDL)) {
+                       log_error("Can't find option with code %u", code);
+               }
 
                /* If the length is outrageous, the options are bad. */
                if (offset + len > length) {
                        /* Avoid reference count overflow */
-                       option_dereference(&option, MDL);
+                       if (option)
+                               option_dereference(&option, MDL);
                        reason = "option length exceeds option buffer length";
                      bogus:
                        log_error("parse_option_buffer: malformed option "
@@ -216,7 +219,8 @@
                        /* non-compliant clients can send it
                         * we'll just drop it and go on */
                        log_debug ("Ignoring empty DHO_HOST_NAME option");
-                       option_dereference(&option, MDL);
+                       if (option)
+                               option_dereference(&option, MDL);
                        offset += len;
                        continue;
                }
@@ -282,7 +286,8 @@
                        option_cache_dereference(&nop, MDL);
                }
 
-               option_dereference(&option, MDL);
+               if (option)
+                       option_dereference(&option, MDL);
                offset += len;
        }
        buffer_dereference (&bp, MDL);