Re: [PATCH v2 3/3] net: dhcp: cap DHCP option string length to 255 bytes

Ahmad Fatoum
2026-04-17T09:50:25Z

On 4/2/26 8:59 AM, Sascha Hauer wrote:
> dhcp_set_string_options() stores the string length in a u8 field but
> uses the full strlen() value for memcpy(). If a user sets a DHCP
> option string (hostname, vendor_id, etc.) longer than 255 bytes, the
> length field silently truncates while memcpy() copies the full string,
> writing past the expected region in the packet buffer.
>
> Cap str_len at 255 to match the maximum DHCP option length defined by
> RFC2132, ensuring the length field and memcpy are consistent.
>
> Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
> Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Reviewed-by: Ahmad Fatoum <a.fatoum@pengutronix.de>

> ---
> net/dhcp.c | 4 ++++
> 1 file changed, 4 insertions(+)
>
> diff --git a/net/dhcp.c b/net/dhcp.c
> index f4e4033351..21d48cfcf2 100644
> --- a/net/dhcp.c
> +++ b/net/dhcp.c
> @@ -173,6 +173,10 @@ static int dhcp_set_string_options(int option, const char *str, u8 *e)
> if (!str_len)
> return 0;
>
> + /* DHCP option length field is a single byte per RFC2132 */
> + if (str_len > 255)
> + str_len = 255;
> +
> *e++ = option;
> *e++ = str_len;
> memcpy(e, str, str_len);
>

--
Pengutronix e.K. | |
Steuerwalder Str. 21 | http://www.pengutronix.de/ |
31137 Hildesheim, Germany | Phone: +49-5121-206917-0 |
Amtsgericht Hildesheim, HRA 2686 | Fax: +49-5121-206917-5555 |