net: ipv6: Fix CID 453851 and CID 436278

CID 453851 : sprintf() shouldn't copy from/to tmp
CID 436278 : DHCP6 option_len should be checked before use

Signed-off-by: Sean Edmond <seanedmond@microsoft.com>
Reviewed-by: Ramon Fried <rfried.dev@gmail.com>

diff --git a/cmd/net.c b/cmd/net.c
index 68d4062..9e1f40a 100644 (file)
--- a/cmd/net.c
+++ b/cmd/net.c
@@ -209,7 +209,7 @@ U_BOOT_CMD(
 
 static void netboot_update_env(void)
 {
-       char tmp[44];
+       char tmp[46];
 
        if (net_gateway.s_addr) {
                ip_to_string(net_gateway, tmp);
@@ -274,20 +274,20 @@ static void netboot_update_env(void)
        if (IS_ENABLED(CONFIG_IPV6)) {
                if (!ip6_is_unspecified_addr(&net_ip6) ||
                    net_prefix_length != 0) {
-                       sprintf(tmp, "%pI6c", &net_ip6);
                        if (net_prefix_length != 0)
-                               sprintf(tmp, "%s/%d", tmp, net_prefix_length);
-
+                               snprintf(tmp, sizeof(tmp), "%pI6c/%d", &net_ip6, net_prefix_length);
+                       else
+                               snprintf(tmp, sizeof(tmp), "%pI6c", &net_ip6);
                        env_set("ip6addr", tmp);
                }
 
                if (!ip6_is_unspecified_addr(&net_server_ip6)) {
-                       sprintf(tmp, "%pI6c", &net_server_ip6);
+                       snprintf(tmp, sizeof(tmp), "%pI6c", &net_server_ip6);
                        env_set("serverip6", tmp);
                }
 
                if (!ip6_is_unspecified_addr(&net_gateway6)) {
-                       sprintf(tmp, "%pI6c", &net_gateway6);
+                       snprintf(tmp, sizeof(tmp), "%pI6c", &net_gateway6);
                        env_set("gatewayip6", tmp);
                }
        }

diff --git a/net/dhcpv6.c b/net/dhcpv6.c
index 0d1c600..73a1067 100644 (file)
--- a/net/dhcpv6.c
+++ b/net/dhcpv6.c
@@ -316,6 +316,11 @@ static void dhcp6_parse_options(uchar *rx_pkt, unsigned int len)
                option_ptr = ((uchar *)option_hdr) + sizeof(struct dhcp6_hdr);
                option_len = ntohs(option_hdr->option_len);
 
+               if (option_ptr + option_len > rx_pkt + len) {
+                       debug("Invalid option length\n");
+                       return;
+               }
+
                switch (ntohs(option_hdr->option_id)) {
                case DHCP6_OPTION_CLIENTID:
                        if (memcmp(option_ptr, sm_params.duid, option_len)