mirror of
http://thekelleys.org.uk/git/dnsmasq.git
synced 2026-10-18 11:09:36 +00:00
Dominik
9e3e0465cd
The loop in grab_extradata_lua checked *next != 0 in the loop condition before the body could test next == end, so when next reached end the byte *end was read out-of-bounds. The non-Lua sibling grab_extradata had the correct order (test next == end before dereferencing). Fix by adopting the same idiom. Security: a DHCP client can supply a vendor-class option whose content fills the extradata buffer with no trailing NUL, causing a 1-byte OOB read in the Lua helper child (already non-root). Requires HAVE_LUASCRIPT and a configured Lua script. Not feasible for triggering a crash from remote reliably. Signed-off-by: Dominik <dl6er@dl6er.de>