From 1c4a97edb50431a1c1fb197d2f3fd06500b90ee7 Mon Sep 17 00:00:00 2001 From: Dominik Date: Thu, 19 Mar 2026 21:51:47 +0100 Subject: [PATCH] rfc2131: fix off-by-one in BOOTP filename netid NUL termination After copying the 128-byte DHCP file field into dhcp_buff2, the sentinel was written to index 129 instead of 128. The byte at index 128 was therefore left holding stale data from the previous DHCP exchange, so a client that fills the entire file field with non-NUL bytes would produce a 129-character netid tag whose last byte is heap garbage. In theory this allows incorrect netid-tag matching; in practice it requires the client to know the heap state of a prior transaction and BOOTP use is uncommon. Security: very-low-severity heap-content exposure that could influence DHCP option selection via tag mismatch; no memory corruption or crash. Signed-off-by: Dominik --- src/rfc2131.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/rfc2131.c b/src/rfc2131.c index 9ff28da..7bdfefd 100644 --- a/src/rfc2131.c +++ b/src/rfc2131.c @@ -597,7 +597,7 @@ size_t dhcp_reply(struct dhcp_context *context, char *iface_name, int int_index, if (mess->file[0]) { memcpy(daemon->dhcp_buff2, mess->file, sizeof(mess->file)); - daemon->dhcp_buff2[sizeof(mess->file) + 1] = 0; /* ensure zero term. */ + daemon->dhcp_buff2[sizeof(mess->file)] = 0; /* ensure zero term. */ id.net = (char *)daemon->dhcp_buff2; id.next = netid; netid = &id;