Skip to content

Commit b0ee47d

Browse files
AniruddhaKanherearchigup
authored andcommitted
Fix DHCPv6 sub-option default case skip
In prvDHCPv6_subOption(), the default case for unknown sub-option types skipped uxLength2 - uxUsed bytes. Since uxUsed is cumulative bytes from the parent option start and uxLength2 is the current sub-option payload length, this subtraction wraps when uxUsed > uxLength2, corrupting the parser index. Fix by skipping uxLength2 bytes. Also add xHasError check to the loop exit condition.
1 parent 328e062 commit b0ee47d

1 file changed

Lines changed: 3 additions & 2 deletions

File tree

source/FreeRTOS_DHCPv6.c

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1196,13 +1196,14 @@ static BaseType_t prvDHCPv6_subOption( uint16_t usOption,
11961196
break;
11971197

11981198
default:
1199-
( void ) xBitConfig_read_uc( pxMessage, NULL, uxLength2 - uxUsed );
1199+
( void ) xBitConfig_read_uc( pxMessage, NULL, uxLength2 );
12001200
FreeRTOS_printf( ( "prvDHCPv6Analyse: skipped unknown option %u\n", usOption2 ) );
12011201
break;
12021202
}
12031203

1204-
if( xReturn != pdTRUE )
1204+
if( ( xReturn != pdTRUE ) || ( pxMessage->xHasError != pdFALSE ) )
12051205
{
1206+
xReturn = pdFALSE;
12061207
FreeRTOS_printf( ( "prvDHCPv6_subOption: One of sub-options %d returns error\n", usOption2 ) );
12071208
break;
12081209
}

0 commit comments

Comments
 (0)