diff options
| author | Anatole Denis <natolumin@unverle.fr> | 2019-10-08 14:02:04 +0200 |
|---|---|---|
| committer | Chris K <c@chrisko.ch> | 2020-06-20 21:42:12 -0700 |
| commit | ff7ce1d50285d8f5467dcb4b8dd4dc08b8fc1f79 (patch) | |
| tree | d4f5be625f7376fbd5e2b5cb9ae448781db4e335 /dhcpv4/dhcpv4.go | |
| parent | 65668712da12ab11520b64097496616d39a50368 (diff) | |
dhcpv4: Avoid a panic in ToBytes() with long strings
When BootFileName is longer than 128 bytes or ServerHostName is longer
than 64 bytes, trying to null-terminate the strings when writing out the
packet causes a panic.
Since the ToBytes() function cannot return errors, silently truncate the
string instead (we do the same with ClientHWAddr if it is longer than 16
bytes for example)
Signed-off-by: Anatole Denis <natolumin@unverle.fr>
Diffstat (limited to 'dhcpv4/dhcpv4.go')
| -rw-r--r-- | dhcpv4/dhcpv4.go | 6 |
1 files changed, 2 insertions, 4 deletions
diff --git a/dhcpv4/dhcpv4.go b/dhcpv4/dhcpv4.go index 0bfea48..db418e1 100644 --- a/dhcpv4/dhcpv4.go +++ b/dhcpv4/dhcpv4.go @@ -492,13 +492,11 @@ func (d *DHCPv4) ToBytes() []byte { copy(buf.WriteN(16), d.ClientHWAddr) var sname [64]byte - copy(sname[:], []byte(d.ServerHostName)) - sname[len(d.ServerHostName)] = 0 + copy(sname[:63], []byte(d.ServerHostName)) buf.WriteBytes(sname[:]) var file [128]byte - copy(file[:], []byte(d.BootFileName)) - file[len(d.BootFileName)] = 0 + copy(file[:127], []byte(d.BootFileName)) buf.WriteBytes(file[:]) // The magic cookie. |