# HG changeset patch # User Roy Marples # Date 1233346752 0 # Node ID 44123747e58b9132839f6eff2aa28e6dbaec61d2 # Parent db1bfa6b44dda997e171d63191fe0a7bbdce16cb We should zero the entire message struct so any options don't overflow into unallocated memory when evaluating them. diff -r db1bfa6b44dd -r 44123747e58b client.c --- a/client.c Thu Jan 29 13:56:12 2009 +0000 +++ b/client.c Fri Jan 30 20:19:12 2009 +0000 @@ -1531,7 +1531,6 @@ struct interface *iface = state->interface; struct dhcp_message *dhcp = NULL; const uint8_t *pp; - uint8_t *p; ssize_t bytes; int retval = -1; @@ -1556,7 +1555,7 @@ continue; } if (!dhcp) - dhcp = xmalloc(sizeof(*dhcp)); + dhcp = xzalloc(sizeof(*dhcp)); memcpy(dhcp, pp, bytes); if (dhcp->cookie != htonl(MAGIC_COOKIE)) { logger(LOG_DEBUG, "bogus cookie, ignoring"); @@ -1579,13 +1578,6 @@ hwaddr_ntoa(dhcp->chaddr, sizeof(dhcp->chaddr))); continue; } - /* We should ensure that the packet is terminated correctly - * if we have space for the terminator */ - if ((size_t)bytes != sizeof(*dhcp)) { - p = (uint8_t *)dhcp + (bytes - 1); - if (*p != DHO_END) - *++p = DHO_END; - } retval = handle_dhcp(state, &dhcp, options); if (retval == 0 && state->options & DHCPCD_TEST) state->options |= DHCPCD_FORKED;