From: Antonio Huete Jimenez <tuxillo@quantumachine.net>
Date: Fri, 3 Aug 2012 23:07:20 +0000 (+0200)
Subject: dhclient - Properly handle zero-length option hints.
X-Git-Url: http://gitweb.dragonflybsd.org/~tuxillo/dragonfly.git/commitdiff_plain/efbe5ab24dc5becd03e4184aa13ef13c68c734a5

dhclient - Properly handle zero-length option hints.

- There was a possible division by zero if a server
  sends us a broken option hints for the proper fix.

Taken-from: OpenBSD
---

diff --git a/sbin/dhclient/options.c b/sbin/dhclient/options.c
index c77e315..14a9858 100644
--- a/sbin/dhclient/options.c
+++ b/sbin/dhclient/options.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: src/sbin/dhclient/options.c,v 1.37 2009/03/10 23:19:36 krw Exp $ */
+/*	$OpenBSD: src/sbin/dhclient/options.c,v 1.38 2011/04/17 19:57:23 phessler Exp $	*/
 
 /* DHCP options parsing and reassembly. */
 
@@ -212,6 +212,13 @@ pretty_print_option(unsigned int code, unsigned char *data, int len,
 			--numelem;
 			fmtbuf[i] = 0;
 			numhunk = 0;
+			if (hunksize == 0) {
+				warning("%s: no size indicator before A"
+				    " in format string: %s",
+				    dhcp_options[code].name,
+				    dhcp_options[code].format);
+				return ("<fmt error>");
+			}
 			break;
 		case 'X':
 			for (k = 0; k < len; k++)