Lib: add size checks to prevent several crashes

[ngadmin] / lib / src / network.c

diff --git a/lib/src/network.c b/lib/src/network.c
index b48461c1fdb903165f318a98f96478676a390900..3f3126bc304301362c0fe2ec1aea127068e1ec0e 100644 (file)
--- a/lib/src/network.c
+++ b/lib/src/network.c
@@ -314,7 +314,7 @@ end:
 }
 
 
-void extractSwitchAttributes (struct swi_attr *sa, const List *l)
+int extractSwitchAttributes (struct swi_attr *sa, const List *l)
 {
        const ListNode *ln;
        const struct attr *at;
@@ -325,6 +325,8 @@ void extractSwitchAttributes (struct swi_attr *sa, const List *l)
        
        for (ln = l->first; ln != NULL; ln = ln->next) {
                at = ln->data;
+               if (at->size == 0)
+                       return -EMSGSIZE;
                
                switch (at->attr) {
                
@@ -357,7 +359,10 @@ void extractSwitchAttributes (struct swi_attr *sa, const List *l)
                        break;
                
                case ATTR_DHCP:
-                       sa->nc.dhcp = (ntohs(*(unsigned short*)at->data) == 1);
+                       /* Note: DHCP attribute is special, it is 2 two bytes long when sent
+                        * by the switch but only 1 byte long when sent by the client
+                        */
+                       sa->nc.dhcp = (at->size == 2) && ((*(unsigned short*)at->data) == 1);
                        break;
                
                case ATTR_FIRM_VER:
@@ -371,9 +376,12 @@ void extractSwitchAttributes (struct swi_attr *sa, const List *l)
                        break;
                
                case ATTR_END:
-                       return;
+                       return 0;
                }
        }
+       
+       
+       return 0;
 }