[PATCH v2 3/3] net: dhcp: cap DHCP option string length to 255 bytes

[Ahmad Fatoum]

On 4/2/26 8:59 AM, Sascha Hauer wrote:
> dhcp_set_string_options() stores the string length in a u8 field but
> uses the full strlen() value for memcpy(). If a user sets a DHCP
> option string (hostname, vendor_id, etc.) longer than 255 bytes, the
> length field silently truncates while memcpy() copies the full string,
> writing past the expected region in the packet buffer.
> 
> Cap str_len at 255 to match the maximum DHCP option length defined by
> RFC2132, ensuring the length field and memcpy are consistent.
> 
> Signed-off-by: Sascha Hauer <s.hauer at pengutronix.de>
> Co-Authored-By: Claude Opus 4.6 (1M context) <noreply at anthropic.com>

Reviewed-by: Ahmad Fatoum <a.fatoum at pengutronix.de>

> ---
>  net/dhcp.c | 4 ++++
>  1 file changed, 4 insertions(+)
> 
> diff --git a/net/dhcp.c b/net/dhcp.c
> index f4e4033351..21d48cfcf2 100644
> --- a/net/dhcp.c
> +++ b/net/dhcp.c
> @@ -173,6 +173,10 @@ static int dhcp_set_string_options(int option, const char *str, u8 *e)
>  	if (!str_len)
>  		return 0;
>  
> +	/* DHCP option length field is a single byte per RFC2132 */
> +	if (str_len > 255)
> +		str_len = 255;
> +
>  	*e++ = option;
>  	*e++ = str_len;
>  	memcpy(e, str, str_len);
> 

-- 
Pengutronix e.K.                  |                             |
Steuerwalder Str. 21              | http://www.pengutronix.de/  |
31137 Hildesheim, Germany         | Phone: +49-5121-206917-0    |
Amtsgericht Hildesheim, HRA 2686  | Fax:   +49-5121-206917-5555 |