[src/trunk]: src/external/mpl/dhcp/dist/common If an option is not found in t...

[christos <christos%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/3898b1385084
branches:  trunk
changeset: 958605:3898b1385084
user:      christos <christos%NetBSD.org@localhost>
date:      Wed Jan 13 15:51:49 2021 +0000

description:
If an option is not found in the standard table, log it and don't try to
dereference it. This prevents crashes from XenServer VM that PXE boots and
includes option 175 in the DHCP request. Reported by Stephen Borrill.

diffstat:

 external/mpl/dhcp/dist/common/options.c |  19 ++++++++++++-------
 1 files changed, 12 insertions(+), 7 deletions(-)

diffs (58 lines):

diff -r 8cb36464e1e5 -r 3898b1385084 external/mpl/dhcp/dist/common/options.c
--- a/external/mpl/dhcp/dist/common/options.c   Wed Jan 13 07:36:56 2021 +0000
+++ b/external/mpl/dhcp/dist/common/options.c   Wed Jan 13 15:51:49 2021 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: options.c,v 1.3 2020/08/03 21:10:56 christos Exp $     */
+/*     $NetBSD: options.c,v 1.4 2021/01/13 15:51:49 christos Exp $     */
 
 /* options.c
 
@@ -29,7 +29,7 @@
  */
 
 #include <sys/cdefs.h>
-__RCSID("$NetBSD: options.c,v 1.3 2020/08/03 21:10:56 christos Exp $");
+__RCSID("$NetBSD: options.c,v 1.4 2021/01/13 15:51:49 christos Exp $");
 
 #define DHCP_OPTION_DATA
 #include "dhcpd.h"
@@ -179,13 +179,16 @@
 
                offset += universe->length_size;
 
-               option_code_hash_lookup(&option, universe->code_hash, &code,
-                                       0, MDL);
+               if (!option_code_hash_lookup(&option, universe->code_hash,
+                   &code, 0, MDL)) {
+                       log_error("Can't find option with code %u", code);
+               }
 
                /* If the length is outrageous, the options are bad. */
                if (offset + len > length) {
                        /* Avoid reference count overflow */
-                       option_dereference(&option, MDL);
+                       if (option)
+                               option_dereference(&option, MDL);
                        reason = "option length exceeds option buffer length";
                      bogus:
                        log_error("parse_option_buffer: malformed option "
@@ -216,7 +219,8 @@
                        /* non-compliant clients can send it
                         * we'll just drop it and go on */
                        log_debug ("Ignoring empty DHO_HOST_NAME option");
-                       option_dereference(&option, MDL);
+                       if (option)
+                               option_dereference(&option, MDL);
                        offset += len;
                        continue;
                }
@@ -282,7 +286,8 @@
                        option_cache_dereference(&nop, MDL);
                }
 
-               option_dereference(&option, MDL);
+               if (option)
+                       option_dereference(&option, MDL);
                offset += len;
        }
        buffer_dereference (&bp, MDL);