From 31e9e94c04b965b99ddd7f03442200ffdf217f8a Mon Sep 17 00:00:00 2001 From: tobias Date: Mon, 28 Jul 2014 16:45:35 +0000 Subject: [PATCH] Fix memory exhaustion occurring on DHCP options with 0 length. halex@ and krw@ pointed out that a NULL check before free can go, too. ok deraadt@, halex@, krw@ --- sbin/dhclient/options.c | 5 ++--- usr.sbin/dhcpd/options.c | 5 ++--- 2 files changed, 4 insertions(+), 6 deletions(-) diff --git a/sbin/dhclient/options.c b/sbin/dhclient/options.c index 3ed71586c9b..39e76a10726 100644 --- a/sbin/dhclient/options.c +++ b/sbin/dhclient/options.c @@ -1,4 +1,4 @@ -/* $OpenBSD: options.c,v 1.69 2014/07/09 12:55:31 krw Exp $ */ +/* $OpenBSD: options.c,v 1.70 2014/07/28 16:45:35 tobias Exp $ */ /* DHCP options parsing and reassembly. */ @@ -610,6 +610,5 @@ do_packet(unsigned int from_port, struct in_addr from, free(info); for (i = 0; i < 256; i++) - if (options[i].len && options[i].data) - free(options[i].data); + free(options[i].data); } diff --git a/usr.sbin/dhcpd/options.c b/usr.sbin/dhcpd/options.c index 91f6395425b..459ad6c8b75 100644 --- a/usr.sbin/dhcpd/options.c +++ b/usr.sbin/dhcpd/options.c @@ -1,4 +1,4 @@ -/* $OpenBSD: options.c,v 1.27 2014/07/11 09:42:27 yasuoka Exp $ */ +/* $OpenBSD: options.c,v 1.28 2014/07/28 16:45:35 tobias Exp $ */ /* DHCP options parsing and reassembly. */ @@ -524,6 +524,5 @@ do_packet(struct interface_info *interface, struct dhcp_packet *packet, /* Free the data associated with the options. */ for (i = 0; i < 256; i++) - if (tp.options[i].len && tp.options[i].data) - free(tp.options[i].data); + free(tp.options[i].data); } -- 2.20.1