@@ -4940,7 +4940,7 @@ static void rx_dhcp_client(struct mg_tcpip_if *ifp, struct pkt *pkt) {
49404940 // perform size check first, then access fields
49414941 uint8_t *p = pkt->dhcp->options,
49424942 *end = (uint8_t *) &pkt->pay.buf[pkt->pay.len];
4943- if (end < (uint8_t *) (pkt->dhcp + 1)) return;
4943+ if (end < p) return; // options are optional, check min header length
49444944 if (memcmp(&pkt->dhcp->xid, ifp->mac + 2, sizeof(pkt->dhcp->xid))) return;
49454945 while (p + 1 < end && p[0] != 255) { // Parse options RFC-1533 #9
49464946 if (p[0] == 1 && p[1] == sizeof(ifp->mask) && p + 6 < end) { // Mask
@@ -5002,7 +5002,7 @@ static void rx_dhcp_server(struct mg_tcpip_if *ifp, struct pkt *pkt) {
50025002 *end = (uint8_t *) &pkt->pay.buf[pkt->pay.len];
50035003 // struct dhcp *req = pkt->dhcp;
50045004 struct dhcp res = {2, 1, 6, 0, 0, 0, 0, 0, 0, 0, 0, {0}, 0, {0}};
5005- if (end < (uint8_t *) (pkt->dhcp + 1)) return;
5005+ if (end < p) return; // options are optional, check min header length
50065006 res.yiaddr = ifp->ip;
50075007 ((uint8_t *) (&res.yiaddr))[3]++; // Offer our IP + 1
50085008 while (p + 1 < end && p[0] != 255) { // Parse options
@@ -5833,11 +5833,11 @@ static void rx_ip(struct mg_tcpip_if *ifp, struct pkt *pkt) {
58335833 mg_ntohs(pkt->udp->dport), (int) pkt->pay.len));
58345834 if (ifp->enable_dhcp_client && pkt->udp->dport == mg_htons(68)) {
58355835 pkt->dhcp = (struct dhcp *) (pkt->udp + 1);
5836- mkpay(pkt, pkt->dhcp + 1 );
5836+ mkpay(pkt, & pkt->dhcp->options );
58375837 rx_dhcp_client(ifp, pkt);
58385838 } else if (ifp->enable_dhcp_server && pkt->udp->dport == mg_htons(67)) {
58395839 pkt->dhcp = (struct dhcp *) (pkt->udp + 1);
5840- mkpay(pkt, pkt->dhcp + 1 );
5840+ mkpay(pkt, & pkt->dhcp->options );
58415841 rx_dhcp_server(ifp, pkt);
58425842 } else if (!rx_udp(ifp, pkt)) {
58435843 // Should send ICMP Destination Unreachable for unicasts, but keep
0 commit comments