From: tobias <tobias@openbsd.org>
Date: Mon, 28 Jul 2014 16:45:35 +0000 (+0000)
Subject: Fix memory exhaustion occurring on DHCP options with 0 length.
X-Git-Url: http://artulab.com/gitweb/?a=commitdiff_plain;h=31e9e94c04b965b99ddd7f03442200ffdf217f8a;p=openbsd

Fix memory exhaustion occurring on DHCP options with 0 length.

halex@ and krw@ pointed out that a NULL check before free can go, too.

ok deraadt@, halex@, krw@
---

diff --git a/sbin/dhclient/options.c b/sbin/dhclient/options.c
index 3ed71586c9b..39e76a10726 100644
--- a/sbin/dhclient/options.c
+++ b/sbin/dhclient/options.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: options.c,v 1.69 2014/07/09 12:55:31 krw Exp $	*/
+/*	$OpenBSD: options.c,v 1.70 2014/07/28 16:45:35 tobias Exp $	*/
 
 /* DHCP options parsing and reassembly. */
 
@@ -610,6 +610,5 @@ do_packet(unsigned int from_port, struct in_addr from,
 	free(info);
 
 	for (i = 0; i < 256; i++)
-		if (options[i].len && options[i].data)
-			free(options[i].data);
+		free(options[i].data);
 }
diff --git a/usr.sbin/dhcpd/options.c b/usr.sbin/dhcpd/options.c
index 91f6395425b..459ad6c8b75 100644
--- a/usr.sbin/dhcpd/options.c
+++ b/usr.sbin/dhcpd/options.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: options.c,v 1.27 2014/07/11 09:42:27 yasuoka Exp $	*/
+/*	$OpenBSD: options.c,v 1.28 2014/07/28 16:45:35 tobias Exp $	*/
 
 /* DHCP options parsing and reassembly. */
 
@@ -524,6 +524,5 @@ do_packet(struct interface_info *interface, struct dhcp_packet *packet,
 
 	/* Free the data associated with the options. */
 	for (i = 0; i < 256; i++)
-		if (tp.options[i].len && tp.options[i].data)
-			free(tp.options[i].data);
+		free(tp.options[i].data);
 }