mirror of
http://thekelleys.org.uk/git/dnsmasq.git
synced 2026-10-29 12:50:47 +00:00
Dominik
b12a9249f6
When t == 0 every conditional branch is skipped and buf is never written, leaving it without a NUL terminator. The caller in dhcp-common.c log_opts() does `p += strlen(p)` immediately after, scanning uninitialised stack memory until it finds a stray zero byte. Reachable from the network: a local attacker can craft a DHCP packet with any time-typed option (e.g. option 51) set to 0x00000000, triggering this path via the option-logging code. Impact is limited to stack bytes appearing in syslog output (information disclosure), not reachable for code execution. Fix by zeroing buf[0] first so the buffer is always well-formed. This bug does not look like it could be a remotely triggerable DoS vector as strlen(buf) on an uninitialised heap buffer will almost certainly find a NUL byte in adjacent heap metadata before hitting an unmapped page. Signed-off-by: Dominik <dl6er@dl6er.de>