diff options
Diffstat (limited to 'package/busybox/patches')
| -rw-r--r-- | package/busybox/patches/244-udhcpc_add_6rd_option.patch | 58 |
1 files changed, 34 insertions, 24 deletions
diff --git a/package/busybox/patches/244-udhcpc_add_6rd_option.patch b/package/busybox/patches/244-udhcpc_add_6rd_option.patch index 25c5ebf6fe..3037708586 100644 --- a/package/busybox/patches/244-udhcpc_add_6rd_option.patch +++ b/package/busybox/patches/244-udhcpc_add_6rd_option.patch @@ -58,7 +58,7 @@ /* really simple implementation, just count the bits */ static int mton(uint32_t mask) { -@@ -177,6 +195,60 @@ static NOINLINE char *xmalloc_optname_op +@@ -177,6 +195,70 @@ static NOINLINE char *xmalloc_optname_op return ret; } @@ -85,33 +85,43 @@ + * We convert it to a string "IPv4MaskLen 6rdPrefixLen 6rdPrefix 6rdBRIPv4Address" + */ + -+ /* IPv4MaskLen */ -+ dest += sprintf(dest, "%u ", *option++); -+ len--; ++ /* Sanity check: ensure that our length is at least 22 bytes, that ++ * IPv4MaskLen is <= 32, 6rdPrefixLen <= 128 and that the sum of ++ * (32 - IPv4MaskLen) + 6rdPrefixLen is less than or equal to 128. ++ * If any of these requirements is not fulfilled, return with empty ++ * value. ++ */ ++ if ((len >= 22) && (*option <= 32) && (*(option+1) <= 128) && ++ (((32 - *option) + *(option+1)) <= 128)) ++ { ++ /* IPv4MaskLen */ ++ dest += sprintf(dest, "%u ", *option++); ++ len--; + -+ /* 6rdPrefixLen */ -+ dest += sprintf(dest, "%u ", *option++); -+ len--; ++ /* 6rdPrefixLen */ ++ dest += sprintf(dest, "%u ", *option++); ++ len--; + -+ /* 6rdPrefix */ -+ dest += sprint_nip6(dest, "", option); -+ option += 16; -+ len -= 16; ++ /* 6rdPrefix */ ++ dest += sprint_nip6(dest, "", option); ++ option += 16; ++ len -= 16; + -+ /* 6rdBRIPv4Addresses */ -+ while (len >= 4) -+ { -+ dest += sprint_nip(dest, " ", option); -+ option += 4; -+ len -= 4; ++ /* 6rdBRIPv4Addresses */ ++ while (len >= 4) ++ { ++ dest += sprint_nip(dest, " ", option); ++ option += 4; ++ len -= 4; + -+ /* the code to determine the option size fails to work with -+ * lengths that are not a multiple of the minimum length, -+ * adding all advertised 6rdBRIPv4Addresses here would -+ * overflow the destination buffer, therefore skip the rest -+ * for now -+ */ -+ break; ++ /* the code to determine the option size fails to work with ++ * lengths that are not a multiple of the minimum length, ++ * adding all advertised 6rdBRIPv4Addresses here would ++ * overflow the destination buffer, therefore skip the rest ++ * for now ++ */ ++ break; ++ } + } + + return ret; |