From b12a9249f6289d9ae74349b5fa357d37c46b2b81 Mon Sep 17 00:00:00 2001 From: Dominik Date: Thu, 19 Mar 2026 21:35:47 +0100 Subject: [PATCH] fix: NUL-terminate buf in prettyprint_time() when t == 0 When t == 0 every conditional branch is skipped and buf is never written, leaving it without a NUL terminator. The caller in dhcp-common.c log_opts() does `p += strlen(p)` immediately after, scanning uninitialised stack memory until it finds a stray zero byte. Reachable from the network: a local attacker can craft a DHCP packet with any time-typed option (e.g. option 51) set to 0x00000000, triggering this path via the option-logging code. Impact is limited to stack bytes appearing in syslog output (information disclosure), not reachable for code execution. Fix by zeroing buf[0] first so the buffer is always well-formed. This bug does not look like it could be a remotely triggerable DoS vector as strlen(buf) on an uninitialised heap buffer will almost certainly find a NUL byte in adjacent heap metadata before hitting an unmapped page. Signed-off-by: Dominik --- src/util.c | 1 + 1 file changed, 1 insertion(+) diff --git a/src/util.c b/src/util.c index e501391..dac5c4c 100644 --- a/src/util.c +++ b/src/util.c @@ -579,6 +579,7 @@ void prettyprint_time(char *buf, unsigned int t) else { unsigned int x, p = 0; + buf[0] = '\0'; if ((x = t/86400)) p += sprintf(&buf[p], "%ud", x); if ((x = (t/3600)%24))