Skip to content

Commit

Permalink
sys/net/dhcpv6: consider option 0 an end marker
Browse files Browse the repository at this point in the history
The REPLY of a TP-Link router (WR400 v4.20) ends with a 0 option
that has a bogus length.
When subtracting the length from the remaining length, we get an
underflow (remaining `len` is 3, option len is 4).

To get a working DHCP response, consider 0 (Reserved) an end marker.
  • Loading branch information
benpicco committed Mar 28, 2022
1 parent 922a1d7 commit 37a4fff
Showing 1 changed file with 4 additions and 0 deletions.
4 changes: 4 additions & 0 deletions sys/net/application_layer/dhcpv6/client.c
Original file line number Diff line number Diff line change
Expand Up @@ -1016,6 +1016,10 @@ static bool _parse_reply(uint8_t *rep, size_t len, uint8_t request_type)
default:
break;
}
/* 0 option is used as an end marker, len can include bogus bytes */
if (!byteorder_ntohs(opt->type)) {
break;
}
}
if ((cid == NULL) || (sid == NULL)) {
DEBUG("DHCPv6 client: ADVERTISE does not contain either server ID "
Expand Down

0 comments on commit 37a4fff

Please sign in to comment.