[PATCH 1/2] net: ipv6: Fix CID 453851 and CID 436278

[seanedmond at linux.microsoft.com]

From: Sean Edmond <seanedmond at microsoft.com>

CID 453851 : sprintf() shouldn't copy from/to tmp
CID 436278 : DHCP6 option_len should be checked before use

Signed-off-by: Sean Edmond <seanedmond at microsoft.com>
---
 cmd/net.c    | 12 ++++++------
 net/dhcpv6.c |  5 +++++
 2 files changed, 11 insertions(+), 6 deletions(-)

diff --git a/cmd/net.c b/cmd/net.c
index 68d406291e..9e1f40a56e 100644
--- a/cmd/net.c
+++ b/cmd/net.c
@@ -209,7 +209,7 @@ U_BOOT_CMD(
 
 static void netboot_update_env(void)
 {
-	char tmp[44];
+	char tmp[46];
 
 	if (net_gateway.s_addr) {
 		ip_to_string(net_gateway, tmp);
@@ -274,20 +274,20 @@ static void netboot_update_env(void)
 	if (IS_ENABLED(CONFIG_IPV6)) {
 		if (!ip6_is_unspecified_addr(&net_ip6) ||
 		    net_prefix_length != 0) {
-			sprintf(tmp, "%pI6c", &net_ip6);
 			if (net_prefix_length != 0)
-				sprintf(tmp, "%s/%d", tmp, net_prefix_length);
-
+				snprintf(tmp, sizeof(tmp), "%pI6c/%d", &net_ip6, net_prefix_length);
+			else
+				snprintf(tmp, sizeof(tmp), "%pI6c", &net_ip6);
 			env_set("ip6addr", tmp);
 		}
 
 		if (!ip6_is_unspecified_addr(&net_server_ip6)) {
-			sprintf(tmp, "%pI6c", &net_server_ip6);
+			snprintf(tmp, sizeof(tmp), "%pI6c", &net_server_ip6);
 			env_set("serverip6", tmp);
 		}
 
 		if (!ip6_is_unspecified_addr(&net_gateway6)) {
-			sprintf(tmp, "%pI6c", &net_gateway6);
+			snprintf(tmp, sizeof(tmp), "%pI6c", &net_gateway6);
 			env_set("gatewayip6", tmp);
 		}
 	}
diff --git a/net/dhcpv6.c b/net/dhcpv6.c
index 0d1c600632..73a1067877 100644
--- a/net/dhcpv6.c
+++ b/net/dhcpv6.c
@@ -316,6 +316,11 @@ static void dhcp6_parse_options(uchar *rx_pkt, unsigned int len)
 		option_ptr = ((uchar *)option_hdr) + sizeof(struct dhcp6_hdr);
 		option_len = ntohs(option_hdr->option_len);
 
+		if (option_ptr + option_len > rx_pkt + len) {
+			debug("Invalid option length\n");
+			return;
+		}
+
 		switch (ntohs(option_hdr->option_id)) {
 		case DHCP6_OPTION_CLIENTID:
 			if (memcmp(option_ptr, sm_params.duid, option_len)
-- 
2.40.0