[PATCH v2 2/3] net: dhcp: use xstrndup for bp_file to prevent read past field

[Ahmad Fatoum]

On 4/2/26 8:59 AM, Sascha Hauer wrote:
> bootp_copy_net_params() uses strlen() and xstrdup() on bp->bp_file,
> which is a fixed 128-byte field in the BOOTP packet. If a DHCP server
> sends a packet where all 128 bytes are non-null, strlen() reads past
> the field boundary into the options data looking for a null terminator,
> and xstrdup() then copies the oversized result.
> 
> Use a simple bp->bp_file[0] check for the non-empty test and
> xstrndup() bounded by sizeof(bp->bp_file) to ensure we never read
> past the field.
> 
> Signed-off-by: Sascha Hauer <s.hauer at pengutronix.de>
> Co-Authored-By: Claude Opus 4.6 (1M context) <noreply at anthropic.com>

Reviewed-by: Ahmad Fatoum <a.fatoum at pengutronix.de>

> ---
>  net/dhcp.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/net/dhcp.c b/net/dhcp.c
> index 1cb3fef5d7..f4e4033351 100644
> --- a/net/dhcp.c
> +++ b/net/dhcp.c
> @@ -158,8 +158,8 @@ static void bootp_copy_net_params(struct bootp *bp)
>  	dhcp_result->ip = net_read_ip(&bp->bp_yiaddr);
>  	dhcp_result->serverip = net_read_ip(&bp->bp_siaddr);
>  
> -	if (strlen(bp->bp_file) > 0)
> -		dhcp_result->bootfile = xstrdup(bp->bp_file);
> +	if (bp->bp_file[0] != '\0')
> +		dhcp_result->bootfile = xstrndup(bp->bp_file, sizeof(bp->bp_file));
>  }
>  
>  static int dhcp_set_string_options(int option, const char *str, u8 *e)
> 

-- 
Pengutronix e.K.                  |                             |
Steuerwalder Str. 21              | http://www.pengutronix.de/  |
31137 Hildesheim, Germany         | Phone: +49-5121-206917-0    |
Amtsgericht Hildesheim, HRA 2686  | Fax:   +49-5121-206917-5555 |