Jerome pointed out on v1 that bounding dhcp_packet_process_options() by the received length isn't enough on its own: dhcp_process_options() itself reads the option-length byte and the option payload without checking either is inside [popt, end), so a packet truncated right after an option code byte (or with a length byte that overruns the buffer) still walks off the end even with the outer bound fixed.
v2 adds a prerequisite patch (1/2) that closes that inner gap first, then rebases the original outer-bound fix (2/2, unchanged from v1) on top of it. With both applied, a short reply now stops parsing at the first truncated option instead of reading past the receive buffer, regardless of whether the truncation lands on the outer BOOTP_HDR_SIZE boundary or inside an individual option. Both patches are checkpatch --strict clean and build warning-free at W=1 for net/bootp.o; a full sandbox build also succeeds. Pranav Rajendran (2): net: bootp: validate DHCP option length before parsing it net: bootp: bound DHCP option parsing by the received packet length net/bootp.c | 42 +++++++++++++++++++++++++++++++----------- 1 file changed, 31 insertions(+), 11 deletions(-) -- 2.50.1 (Apple Git-155)
