We should zero the entire message struct so any options don't overflow into unallocated memory when evaluating them.dhcpcd-4.0.9

1 files changed, 1 insertions, 9 deletions

diff --git a/client.c b/client.c
index 757f236a..0d242e87 100644
--- a/client.c
+++ b/client.c
@@ -1531,7 +1531,6 @@ handle_dhcp_packet(struct if_state *state, const struct options *options)
 	struct interface *iface = state->interface;
 	struct dhcp_message *dhcp = NULL;
 	const uint8_t *pp;
-	uint8_t *p;
 	ssize_t bytes;
 	int retval = -1;
 
@@ -1556,7 +1555,7 @@ handle_dhcp_packet(struct if_state *state, const struct options *options)
 			continue;
 		}
 		if (!dhcp)
-			dhcp = xmalloc(sizeof(*dhcp));
+			dhcp = xzalloc(sizeof(*dhcp));
 		memcpy(dhcp, pp, bytes);
 		if (dhcp->cookie != htonl(MAGIC_COOKIE)) {
 			logger(LOG_DEBUG, "bogus cookie, ignoring");
@@ -1579,13 +1578,6 @@ handle_dhcp_packet(struct if_state *state, const struct options *options)
 			       hwaddr_ntoa(dhcp->chaddr, sizeof(dhcp->chaddr)));
 			continue;
 		}
-		/* We should ensure that the packet is terminated correctly
-		 * if we have space for the terminator */
-		if ((size_t)bytes != sizeof(*dhcp)) {
-			p = (uint8_t *)dhcp + (bytes - 1);
-			if (*p != DHO_END)
-				*++p = DHO_END;
-		}
 		retval = handle_dhcp(state, &dhcp, options);
 		if (retval == 0 && state->options & DHCPCD_TEST)
 			state->options |= DHCPCD_FORKED;