Page MenuHomeFreeBSD
Files F110059269

D8492.diff
No OneTemporary
Actions

D8492.diff
View Options

Index: head/lib/libstand/bootp.c
===================================================================
--- head/lib/libstand/bootp.c
+++ head/lib/libstand/bootp.c
@@ -39,6 +39,7 @@
__FBSDID("$FreeBSD$");
#include <sys/types.h>
+#include <sys/limits.h>
#include <sys/endian.h>
#include <netinet/in.h>
#include <netinet/in_systm.h>
@@ -403,11 +404,29 @@
strlcpy(hostname, val, sizeof(hostname));
}
if (tag == TAG_INTF_MTU) {
+ intf_mtu = 0;
if ((val = getenv("dhcp.interface-mtu")) != NULL) {
- intf_mtu = (u_int)strtoul(val, NULL, 0);
- } else {
- intf_mtu = be16dec(cp);
+ unsigned long tmp;
+ char *end;
+
+ errno = 0;
+ /*
+ * Do not allow MTU to exceed max IPv4 packet
+ * size, max value of 16-bit word.
+ */
+ tmp = strtoul(val, &end, 0);
+ if (errno != 0 ||
+ *val == '\0' || *end != '\0' ||
+ tmp > USHRT_MAX) {
+ printf("%s: bad value: \"%s\", "
+ "ignoring\n",
+ "dhcp.interface-mtu", val);
+ } else {
+ intf_mtu = (u_int)tmp;
+ }
}
+ if (intf_mtu <= 0)
+ intf_mtu = be16dec(cp);
}
#ifdef SUPPORT_DHCP
if (tag == TAG_DHCP_MSGTYPE) {
Index: head/sys/boot/common/dev_net.c
===================================================================
--- head/sys/boot/common/dev_net.c
+++ head/sys/boot/common/dev_net.c
@@ -175,7 +175,7 @@
}
if (intf_mtu != 0) {
char mtu[16];
- sprintf(mtu, "%u", intf_mtu);
+ snprintf(mtu, sizeof(mtu), "%u", intf_mtu);
setenv("boot.netif.mtu", mtu, 1);
}
Index: head/sys/boot/i386/libi386/pxe.c
===================================================================
--- head/sys/boot/i386/libi386/pxe.c
+++ head/sys/boot/i386/libi386/pxe.c
@@ -342,7 +342,7 @@
}
if (intf_mtu != 0) {
char mtu[16];
- sprintf(mtu, "%u", intf_mtu);
+ snprintf(sizeof(mtu), mtu, "%u", intf_mtu);
setenv("boot.netif.mtu", mtu, 1);
}
printf("pxe_open: server addr: %s\n", inet_ntoa(rootip));

File Metadata

Mime Type
text/plain
Expires
Fri, Feb 14, 2:34 AM (18 h, 44 m)
Storage Engine
blob
Storage Format
Raw Data
Storage Handle
16636254
Default Alt Text
D8492.diff (1 KB)

Event Timeline