Skip to content

Commit c05e1da

Browse files
Mika TervonenMika Tervonen
authored andcommitted
Fix DHCP server Uninitialized memory read
Removed not needed boolean and structure Fixed the length calculation when address allocation fails
1 parent 77229ee commit c05e1da

File tree

1 file changed

+10
-14
lines changed

1 file changed

+10
-14
lines changed

source/DHCPv6_Server/DHCPv6_Server_service.c

Lines changed: 10 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -88,36 +88,32 @@ static void DHCP_server_service_timer_stop(void)
8888
int DHCPv6_server_respond_client(dhcpv6_gua_server_entry_s *serverBase, dhcpv6_reply_packet_s *replyPacket, dhcp_ia_non_temporal_params_t *dhcp_ia_non_temporal_params, dhcpv6_gua_response_t *response, bool allocateNew)
8989
{
9090
dhcpv6_allocated_address_t *dhcp_allocated_address = NULL;
91-
dhcpv6_ia_non_temporal_address_s nonTemporalAddress;
92-
bool address_allocated = false;
9391
//Validate Client DUID
9492
dhcp_link_options_params_t clientDUID;
93+
9594
if (libdhcpv6_get_link_address_from_duid(replyPacket->clientDUID.duid, replyPacket->clientDUID.duid_length, replyPacket->clientDUID.type, &clientDUID) == 0) {
9695
dhcp_allocated_address = libdhcpv6_address_allocate(serverBase, clientDUID.link_id, clientDUID.link_type, dhcp_ia_non_temporal_params->iaId, dhcp_ia_non_temporal_params->T0, dhcp_ia_non_temporal_params->T1, allocateNew);
9796
}
9897
if (dhcp_allocated_address) {
99-
address_allocated = true;
100-
nonTemporalAddress.requestedAddress = dhcp_allocated_address->nonTemporalAddress;
101-
nonTemporalAddress.validLifeTime = dhcp_allocated_address->lifetime;
102-
nonTemporalAddress.preferredLifeTime = dhcp_allocated_address->preferredLifetime;
103-
10498
if (serverBase->addCb) {
10599
dhcp_address_cache_update_t update_info;
106100
update_info.allocatedAddress = dhcp_allocated_address->nonTemporalAddress;
107101
update_info.allocatedNewAddress = allocateNew;
108-
update_info.validLifeTime = nonTemporalAddress.validLifeTime;
102+
update_info.validLifeTime = dhcp_allocated_address->lifetime;
109103

110104
if (!serverBase->addCb(serverBase->interfaceId, &update_info, serverBase->guaPrefix)) {
111-
address_allocated = false;
112105
libdhcpv6_address_delete(serverBase, dhcp_allocated_address->nonTemporalAddress);
106+
dhcp_allocated_address = NULL;
113107
}
114108
}
115109
}
116110

117-
response->responseLength = libdhcpv6_address_reply_message_len(replyPacket->clientDUID.duid_length, replyPacket->serverDUID.duid_length, 0, replyPacket->rapidCommit, address_allocated);
111+
response->responseLength = libdhcpv6_address_reply_message_len(replyPacket->clientDUID.duid_length, replyPacket->serverDUID.duid_length, 0, replyPacket->rapidCommit, (dhcp_allocated_address != NULL));
118112
//Calculate DNS LIST and Vendor data lengths here
119-
response->responseLength += libdhcpv6_dns_server_message_sizes(serverBase);
120-
response->responseLength += libdhcpv6_vendor_data_message_sizes(serverBase);
113+
if (dhcp_allocated_address) {
114+
response->responseLength += libdhcpv6_dns_server_message_sizes(serverBase);
115+
response->responseLength += libdhcpv6_vendor_data_message_sizes(serverBase);
116+
}
121117

122118
response->responsePtr = ns_dyn_mem_temporary_alloc(response->responseLength);
123119
if (response->responsePtr) {
@@ -126,9 +122,9 @@ int DHCPv6_server_respond_client(dhcpv6_gua_server_entry_s *serverBase, dhcpv6_r
126122
ptr = libdhcpv6_header_write(ptr, DHCPV6_REPLY_TYPE, replyPacket->transaction_ID);
127123
ptr = libdhcpv6_duid_option_write(ptr, DHCPV6_SERVER_ID_OPTION, &replyPacket->serverDUID); //16
128124
ptr = libdhcpv6_duid_option_write(ptr, DHCPV6_CLIENT_ID_OPTION, &replyPacket->clientDUID); //16
129-
if (address_allocated) {
125+
if (dhcp_allocated_address) {
130126
ptr = libdhcpv6_identity_association_option_write(ptr, replyPacket->iaId, replyPacket->T0, replyPacket->T1, true);
131-
ptr = libdhcpv6_ia_address_option_write(ptr, nonTemporalAddress.requestedAddress, nonTemporalAddress.preferredLifeTime, nonTemporalAddress.validLifeTime);
127+
ptr = libdhcpv6_ia_address_option_write(ptr, dhcp_allocated_address->nonTemporalAddress, dhcp_allocated_address->preferredLifetime, dhcp_allocated_address->lifetime);
132128
//Write DNS LIST and Vendor data here
133129
ptr = libdhcpv6_dns_server_message_writes(serverBase, ptr);
134130
ptr = libdhcpv6_vendor_data_message_writes(serverBase, ptr);

0 commit comments

Comments
 (0)