[src/trunk]: src/external/mpl/dhcp/dist/common If an option is not found in t...

[christos <christos%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/5833baee1d5e
branches:  trunk
changeset: 979829:5833baee1d5e
user:      christos <christos%NetBSD.org@localhost>
date:      Wed Jan 13 15:51:49 2021 +0000

description:
If an option is not found in the standard table, log it and don't try to
dereference it. This prevents crashes from XenServer VM that PXE boots and
includes option 175 in the DHCP request. Reported by Stephen Borrill.

diffstat:

 external/mpl/dhcp/dist/common/options.c |  19 ++++++++++++-------
 1 files changed, 12 insertions(+), 7 deletions(-)

diffs (58 lines):

diff -r 6ad7687a5797 -r 5833baee1d5e external/mpl/dhcp/dist/common/options.c
--- a/external/mpl/dhcp/dist/common/options.c   Wed Jan 13 07:36:56 2021 +0000
+++ b/external/mpl/dhcp/dist/common/options.c   Wed Jan 13 15:51:49 2021 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: options.c,v 1.3 2020/08/03 21:10:56 christos Exp $     */
+/*     $NetBSD: options.c,v 1.4 2021/01/13 15:51:49 christos Exp $     */
 
 /* options.c
 
@@ -29,7 +29,7 @@
  */
 
 #include <sys/cdefs.h>
-__RCSID("$NetBSD: options.c,v 1.3 2020/08/03 21:10:56 christos Exp $");
+__RCSID("$NetBSD: options.c,v 1.4 2021/01/13 15:51:49 christos Exp $");
 
 #define DHCP_OPTION_DATA
 #include "dhcpd.h"
@@ -179,13 +179,16 @@
 
                offset += universe->length_size;
 
-               option_code_hash_lookup(&option, universe->code_hash, &code,
-                                       0, MDL);
+               if (!option_code_hash_lookup(&option, universe->code_hash,
+                   &code, 0, MDL)) {
+                       log_error("Can't find option with code %u", code);
+               }
 
                /* If the length is outrageous, the options are bad. */
                if (offset + len > length) {
                        /* Avoid reference count overflow */
-                       option_dereference(&option, MDL);
+                       if (option)
+                               option_dereference(&option, MDL);
                        reason = "option length exceeds option buffer length";
                      bogus:
                        log_error("parse_option_buffer: malformed option "
@@ -216,7 +219,8 @@
                        /* non-compliant clients can send it
                         * we'll just drop it and go on */
                        log_debug ("Ignoring empty DHO_HOST_NAME option");
-                       option_dereference(&option, MDL);
+                       if (option)
+                               option_dereference(&option, MDL);
                        offset += len;
                        continue;
                }
@@ -282,7 +286,8 @@
                        option_cache_dereference(&nop, MDL);
                }
 
-               option_dereference(&option, MDL);
+               if (option)
+                       option_dereference(&option, MDL);
                offset += len;
        }
        buffer_dereference (&bp, MDL);