From 9e3e0465cddea9c0c3362db94afee52191651545 Mon Sep 17 00:00:00 2001 From: Dominik Date: Thu, 19 Mar 2026 21:45:11 +0100 Subject: [PATCH] helper: fix OOB read in grab_extradata_lua bounds check The loop in grab_extradata_lua checked *next != 0 in the loop condition before the body could test next == end, so when next reached end the byte *end was read out-of-bounds. The non-Lua sibling grab_extradata had the correct order (test next == end before dereferencing). Fix by adopting the same idiom. Security: a DHCP client can supply a vendor-class option whose content fills the extradata buffer with no trailing NUL, causing a 1-byte OOB read in the Lua helper child (already non-root). Requires HAVE_LUASCRIPT and a configured Lua script. Not feasible for triggering a crash from remote reliably. Signed-off-by: Dominik --- src/helper.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/src/helper.c b/src/helper.c index 72f81fe..dcae96c 100644 --- a/src/helper.c +++ b/src/helper.c @@ -740,9 +740,11 @@ static unsigned char *grab_extradata_lua(unsigned char *buf, unsigned char *end, if (!buf || (buf == end)) return NULL; - for (next = buf; *next != 0; next++) + for (next = buf; ; next++) if (next == end) return NULL; + else if (*next == 0) + break; if (next != buf) {