From 4d8d5b7c4426e62375235cf4903b6cb53bb193d3 Mon Sep 17 00:00:00 2001 From: Denys Vlasenko Date: Thu, 12 Mar 2026 13:23:48 +0100 Subject: [PATCH 2/2] udhcpc6: check the size of D6_OPT_IAPREFIX option function old new delta option_to_env 694 711 +17 CVE: CVE-2026-29004 Upstream-Status: Backport [https://git.busybox.net/busybox/commit/archival?id=d368f3f7836d1c2484c8f839316e5c93e76d4409] Signed-off-by: Denys Vlasenko (cherry picked from commit d368f3f7836d1c2484c8f839316e5c93e76d4409) Signed-off-by: Hugo SIMELIERE (Schneider Electric) --- networking/udhcp/d6_dhcpc.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/networking/udhcp/d6_dhcpc.c b/networking/udhcp/d6_dhcpc.c index 62cc0f466..64a41c9d8 100644 --- a/networking/udhcp/d6_dhcpc.c +++ b/networking/udhcp/d6_dhcpc.c @@ -287,8 +287,8 @@ static void option_to_env(const uint8_t *option, const uint8_t *option_end) * | valid-lifetime | * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ */ - /* Make sure payload contains an address */ - if (option[3] < 24) + /* Make sure payload exists */ + if (option[3] < (16 + 4 + 4)) break; sprint_nip6(ipv6str, option + 4); @@ -332,6 +332,9 @@ static void option_to_env(const uint8_t *option, const uint8_t *option_end) * | | * +-+-+-+-+-+-+-+-+ */ + /* Make sure payload exists */ + if (option[3] < (4 + 4 + 1 + 16)) + break; move_from_unaligned32(v32, option + 4 + 4); v32 = ntohl(v32); *new_env() = xasprintf("ipv6prefix_lease=%u", (unsigned)v32); -- 2.43.0