From 8ceb8ee9b5b34a7425e00651b0a3f45dc4fb9e08 Mon Sep 17 00:00:00 2001 From: Dominik Date: Thu, 19 Mar 2026 21:57:11 +0100 Subject: [PATCH] dhcp-common: bounds-check label index before reading in OT_RFC1035_NAME decoder MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit In option_string(), the RFC1035-name label decoder sets i = l (the position past the current label) and then reads val[i] to decide whether to append a '.' separator — but without first checking that i < opt_len. If the last label ends exactly at the option boundary (no NUL terminator), i == opt_len and val[i] reads one byte beyond the option data. The read lands inside the packet buffer so no crash occurs, but the out-of-bounds byte (typically the next DHCPv6 option's type field) could produce a spurious trailing '.' in --log-dhcp output when a client sends a domain-search/nis-domain option without a trailing NUL. Security: OOB read of 1 byte from a network-supplied DHCPv6 packet; reachable only with --log-dhcp enabled; no memory corruption, crash, or meaningful information disclosure. Signed-off-by: Dominik --- src/dhcp-common.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/dhcp-common.c b/src/dhcp-common.c index 95e2ad3..59dcbcd 100644 --- a/src/dhcp-common.c +++ b/src/dhcp-common.c @@ -882,7 +882,7 @@ char *option_string(int prot, unsigned int opt, unsigned char *val, int opt_len, buf[j++] = c; } i = l; - if (val[i] != 0 && j < buf_len) + if (i < opt_len && val[i] != 0 && j < buf_len) buf[j++] = '.'; } }