Bug#1024357: dhcpcd-base: segmentation fault in manager process

2022-11-21 Thread Alexander Inyukhin
I found that the option 51 (lease time) was specified twice inside server reply.



Bug#1024357: dhcpcd-base: segmentation fault in manager process

2022-11-18 Thread Alexander Inyukhin
Package: dhcpcd-base
Version: 9.4.1-11
Severity: important

Dear Maintainer,

I am getting SEGV from the dhcpcd management process while
trying to connect some particular network.
Things works fine when interface is confugured for the first time.
The crash is occured after reconnection/reconfiguration.

Here is the backtrace.

#0  0x5654ac43dffc in memcpy (__len=4, __src=0x5654ad7ad5cb, __dest=0x0)
at /usr/include/x86_64-linux-gnu/bits/string_fortified.h:29
#1  get_option (ctx=ctx@entry=0x7ffc25675830, bootp=bootp@entry=0x5654ad7ad4d0, 
bootp_len=bootp_len@entry=354, opt=opt@entry=51, 
opt_len=opt_len@entry=0x7ffc25675670) at ./src/dhcp.c:263
#2  0x5654ac43feec in get_option_uint32 (option=51 '3', bootp_len=354, 
bootp=0x5654ad7ad4d0, i=0x5654ad799764, ctx=0x7ffc25675830) at 
./src/dhcp.c:309
#3  get_lease (ifp=ifp@entry=0x5654ad799400, lease=lease@entry=0x5654ad799758, 
bootp=0x5654ad7ad4d0, len=354) at ./src/dhcp.c:1440
#4  0x5654ac443188 in dhcp_start1 (arg=0x5654ad799400) at ./src/dhcp.c:4037
#5  0x5654ac42c1b2 in eloop_start (eloop=0x5654ad7aaba0, 
signals=signals@entry=0x7ffc25675a78) at ./src/eloop.c:736
#6  0x5654ac425510 in main (argc=, argv=, 
envp=) at ./src/dhcpcd.c:2553

ctx->opt_buffer is NULL at ./src/dhcp.c:263 while ctx->opt_buffer_len is 8
This shouldn't happen, I guess.

Unfortunately, the option parsing code looks too tricky to me to investigate 
further.