Fix memory exhaustion occurring on DHCP options with 0 length.

halex@ and krw@ pointed out that a NULL check before free can go, too.

ok deraadt@, halex@, krw@

diff --git a/sbin/dhclient/options.c b/sbin/dhclient/options.c
index 3ed7158..39e76a1 100644 (file)
--- a/sbin/dhclient/options.c
+++ b/sbin/dhclient/options.c
@@ -1,4 +1,4 @@
-/*     $OpenBSD: options.c,v 1.69 2014/07/09 12:55:31 krw Exp $        */
+/*     $OpenBSD: options.c,v 1.70 2014/07/28 16:45:35 tobias Exp $     */
 
 /* DHCP options parsing and reassembly. */
 
@@ -610,6 +610,5 @@ do_packet(unsigned int from_port, struct in_addr from,
        free(info);
 
        for (i = 0; i < 256; i++)
-               if (options[i].len && options[i].data)
-                       free(options[i].data);
+               free(options[i].data);
 }

diff --git a/usr.sbin/dhcpd/options.c b/usr.sbin/dhcpd/options.c
index 91f6395..459ad6c 100644 (file)
--- a/usr.sbin/dhcpd/options.c
+++ b/usr.sbin/dhcpd/options.c
@@ -1,4 +1,4 @@
-/*     $OpenBSD: options.c,v 1.27 2014/07/11 09:42:27 yasuoka Exp $    */
+/*     $OpenBSD: options.c,v 1.28 2014/07/28 16:45:35 tobias Exp $     */
 
 /* DHCP options parsing and reassembly. */
 
@@ -524,6 +524,5 @@ do_packet(struct interface_info *interface, struct dhcp_packet *packet,
 
        /* Free the data associated with the options. */
        for (i = 0; i < 256; i++)
-               if (tp.options[i].len && tp.options[i].data)
-                       free(tp.options[i].data);
+               free(tp.options[i].data);
 }