From 1e14c5c577a7bd46f42315e9bc445419770041a7 Mon Sep 17 00:00:00 2001 From: Denys Vlasenko Date: Thu, 12 Mar 2026 13:23:48 +0100 Subject: [PATCH 2/2] udhcpc6: check the size of D6_OPT_IAPREFIX option function old new delta option_to_env 694 711 +17 Signed-off-by: Denys Vlasenko CVE: CVE-2026-29004 Upstream-Status: Backport [https://github.com/vda-linux/busybox_mirror/commit/d368f3f7836d1c2484c8f839316e5c93e76d4409] Signed-off-by: Chen Qi --- networking/udhcp/d6_dhcpc.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/networking/udhcp/d6_dhcpc.c b/networking/udhcp/d6_dhcpc.c index d13b05829..1851cee2a 100644 --- a/networking/udhcp/d6_dhcpc.c +++ b/networking/udhcp/d6_dhcpc.c @@ -287,8 +287,8 @@ static void option_to_env(const uint8_t *option, const uint8_t *option_end) * | valid-lifetime | * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ */ - /* Make sure payload contains an address */ - if (option[3] < 24) + /* Make sure payload exists */ + if (option[3] < (16 + 4 + 4)) break; sprint_nip6(ipv6str, option + 4); @@ -332,6 +332,9 @@ static void option_to_env(const uint8_t *option, const uint8_t *option_end) * | | * +-+-+-+-+-+-+-+-+ */ + /* Make sure payload exists */ + if (option[3] < (4 + 4 + 1 + 16)) + break; move_from_unaligned32(v32, option + 4 + 4); v32 = ntohl(v32); *new_env() = xasprintf("ipv6prefix_lease=%u", (unsigned)v32); -- 2.34.1