On Thu, May 18, 2023 at 10:35 PM seanedmond@linux.microsoft.com wrote:

From: Sean Edmond seanedmond@microsoft.com

CID 453851 : sprintf() shouldn't copy from/to tmp CID 436278 : DHCP6 option_len should be checked before use

Signed-off-by: Sean Edmond seanedmond@microsoft.com

cmd/net.c | 12 ++++++------ net/dhcpv6.c | 5 +++++ 2 files changed, 11 insertions(+), 6 deletions(-)

diff --git a/cmd/net.c b/cmd/net.c index 68d406291e..9e1f40a56e 100644 --- a/cmd/net.c +++ b/cmd/net.c @@ -209,7 +209,7 @@ U_BOOT_CMD(

static void netboot_update_env(void) {

•   char tmp[44];
  

•   char tmp[46];
  
    if (net_gateway.s_addr) {
            ip_to_string(net_gateway, tmp);
  

@@ -274,20 +274,20 @@ static void netboot_update_env(void) if (IS_ENABLED(CONFIG_IPV6)) { if (!ip6_is_unspecified_addr(&net_ip6) || net_prefix_length != 0) {

•                   sprintf(tmp, "%pI6c", &net_ip6);
                    if (net_prefix_length != 0)
  

•                           sprintf(tmp, "%s/%d", tmp, net_prefix_length);
  

•                           snprintf(tmp, sizeof(tmp), "%pI6c/%d", &net_ip6, net_prefix_length);
  

•                   else
  

•                           snprintf(tmp, sizeof(tmp), "%pI6c", &net_ip6);
                    env_set("ip6addr", tmp);
            }
  
            if (!ip6_is_unspecified_addr(&net_server_ip6)) {
  

•                   sprintf(tmp, "%pI6c", &net_server_ip6);
  

•                   snprintf(tmp, sizeof(tmp), "%pI6c", &net_server_ip6);
                    env_set("serverip6", tmp);
            }
  
            if (!ip6_is_unspecified_addr(&net_gateway6)) {
  

•                   sprintf(tmp, "%pI6c", &net_gateway6);
  

•                   snprintf(tmp, sizeof(tmp), "%pI6c", &net_gateway6);
                    env_set("gatewayip6", tmp);
            }
    }
  

diff --git a/net/dhcpv6.c b/net/dhcpv6.c index 0d1c600632..73a1067877 100644 --- a/net/dhcpv6.c +++ b/net/dhcpv6.c @@ -316,6 +316,11 @@ static void dhcp6_parse_options(uchar *rx_pkt, unsigned int len) option_ptr = ((uchar *)option_hdr) + sizeof(struct dhcp6_hdr); option_len = ntohs(option_hdr->option_len);

•           if (option_ptr + option_len > rx_pkt + len) {
  

•                   debug("Invalid option length\n");
  

•                   return;
  

•           }
  

•           switch (ntohs(option_hdr->option_id)) {
            case DHCP6_OPTION_CLIENTID:
                    if (memcmp(option_ptr, sm_params.duid, option_len)
  

-- 2.40.0

Reviewed-by: Ramon Fried rfried.dev@gmail.com