ced4f8d1d3
When resizing DHCP options, iPXE currently calculates the length to be copied by subtracting the destination pointer from the end of buffer pointer. This works and guarantees not to write beyond the end of the buffer, but may end up reading beyond the end of the buffer. Fix by calculating the required length exactly. Signed-off-by: Michael Brown <mcb30@ipxe.org> |
||
|---|---|---|
| .. | ||
| 80211 | ||
| infiniband | ||
| oncrpc | ||
| tcp | ||
| udp | ||
| aoe.c | ||
| arp.c | ||
| dhcpopts.c | ||
| dhcppkt.c | ||
| eapol.c | ||
| eth_slow.c | ||
| ethernet.c | ||
| fakedhcp.c | ||
| fc.c | ||
| fcels.c | ||
| fcns.c | ||
| fcoe.c | ||
| fcp.c | ||
| fragment.c | ||
| icmp.c | ||
| icmpv4.c | ||
| icmpv6.c | ||
| infiniband.c | ||
| iobpad.c | ||
| ipv4.c | ||
| ipv6.c | ||
| ndp.c | ||
| neighbour.c | ||
| netdev_settings.c | ||
| netdevice.c | ||
| nullnet.c | ||
| ping.c | ||
| rarp.c | ||
| retry.c | ||
| socket.c | ||
| tcp.c | ||
| tcpip.c | ||
| tls.c | ||
| udp.c | ||
| validator.c | ||
| vlan.c | ||