[PATCH v2 3/3] net: dhcp: cap DHCP option string length to 255 bytes

Sascha Hauer
2026-04-02T07:00:33Z

dhcp_set_string_options() stores the string length in a u8 field but
uses the full strlen() value for memcpy(). If a user sets a DHCP
option string (hostname, vendor_id, etc.) longer than 255 bytes, the
length field silently truncates while memcpy() copies the full string,
writing past the expected region in the packet buffer.

Cap str_len at 255 to match the maximum DHCP option length defined by
RFC2132, ensuring the length field and memcpy are consistent.

Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---
net/dhcp.c | 4 ++++
1 file changed, 4 insertions(+)

diff --git a/net/dhcp.c b/net/dhcp.c
index f4e4033351..21d48cfcf2 100644
--- a/net/dhcp.c
+++ b/net/dhcp.c
@@ -173,6 +173,10 @@ static int dhcp_set_string_options(int option, const char *str, u8 *e)
if (!str_len)
return 0;

+ /* DHCP option length field is a single byte per RFC2132 */
+ if (str_len > 255)
+ str_len = 255;
+
*e++ = option;
*e++ = str_len;
memcpy(e, str, str_len);

--
2.47.3