mirror of
http://thekelleys.org.uk/git/dnsmasq.git
synced 2026-10-19 11:19:34 +00:00
Dominik
1c4a97edb5
After copying the 128-byte DHCP file field into dhcp_buff2, the sentinel was written to index 129 instead of 128. The byte at index 128 was therefore left holding stale data from the previous DHCP exchange, so a client that fills the entire file field with non-NUL bytes would produce a 129-character netid tag whose last byte is heap garbage. In theory this allows incorrect netid-tag matching; in practice it requires the client to know the heap state of a prior transaction and BOOTP use is uncommon. Security: very-low-severity heap-content exposure that could influence DHCP option selection via tag mismatch; no memory corruption or crash. Signed-off-by: Dominik <dl6er@dl6er.de>