Skip to content

[dhcp] fix raw server option bounds checks - #11940

Merged
Rbb666 merged 1 commit into
RT-Thread:masterfrom
usualtreee:fix/dhcpd-raw-option-bounds
Oct 28, 2026
Merged

[dhcp] fix raw server option bounds checks#11940
Rbb666 merged 1 commit into
RT-Thread:masterfrom
usualtreee:fix/dhcpd-raw-option-bounds

Conversation

@usualtreee

@usualtreee usualtreee commented Oct 28, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

拉取/合并请求描述：(PR description)

为什么提交这份PR (why to submit this PR)

Fixes #11913.

raw API DHCP 服务器在遍历客户端选项时，可能读取缺失的长度字节，或返回内容被截断的选项。MESSAGE_TYPE 和 REQUESTED_IP 调用点随后读取未检查长度的值，可能越界读取。此前还会按预分配的 1500 字节缓冲区解析，超过实际收到的数据范围。

你的解决方案是什么 (what is your solution)

  • 在读取长度字节前检查选项头完整，并在返回选项或推进指针前确认声明内容位于报文内。
  • 两个 REQUESTED_IP 调用点要求 value 至少 4 字节，MESSAGE_TYPE 要求至少 1 字节。
  • 拒绝不足 DHCP_OPTIONS_OFS 的报文，并在释放输入 pbuf 前根据实际 p->tot_len 计算选项长度。
  • 显式包含 string.h。仅修改 dhcp_server_raw.c。

请提供验证的bsp和config (provide the config and bsp)

  • BSP: bsp/qemu-vexpress-a9。
  • .config: CONFIG_RT_USING_LWIP=y、CONFIG_RT_USING_LWIP203=y、CONFIG_LWIP_USING_DHCPD=y。测试程序启动 raw DHCP 服务器，通过 QEMU socket/mcast 网络后端与主机测试客户端交互；临时测试配置未混入本次源码提交。
  • action: 已有本地 QEMU 构建及运行验证；上游 CI 状态请见本 PR 的 Checks。

验证结果：

  1. 从待提交源码提取选项查找函数的 12 项主机回归全部通过（ASAN）。覆盖缺失长度/值、声明长度超出报文、过短 REQUESTED_IP、零长度 MESSAGE_TYPE，以及正常、恰好完整、未知选项跳过等情况。调用方值读取采用等价测试代码。
  2. 200000 次固定种子、长度 0–64 字节的随机输入测试通过（ASAN＋UBSAN）。
  3. QEMU 端到端验证通过：DISCOVER → OFFER、REQUEST → ACK；截断 MESSAGE_TYPE 和声明长度超出实际数据的报文无响应；之后正常 DISCOVER 仍能收到 OFFER。
PASS DISCOVER_OFFER yiaddr=10.0.2.2 server=10.0.2.15
PASS REQUEST_ACK yiaddr=10.0.2.2 server=10.0.2.15
PASS MALFORMED_TRUNCATED_NO_RESPONSE
PASS MALFORMED_DECLARED_OVERRUN_NO_RESPONSE
PASS SERVER_ALIVE_AFTER_MALFORMED yiaddr=10.0.2.2
E2E_ALL_PASS
FUZZ_OK iterations=200000

提交前复核重新编译了上述主机测试，并复跑此前构建的 QEMU 镜像；该次复核未重新构建完整镜像。尚未做实板及全部架构验证。

当前拉取/合并请求的状态 Intent for your PR

必须选择一项 Choose one (Mandatory):

  • 本拉取/合并请求是一个草稿版本 This PR is for a code-review and is intended to get feedback
  • 本拉取/合并请求是一个成熟版本 This PR is mature, and ready to be integrated into the repo

代码质量 Code Quality：

我在这个拉取/合并请求中已经考虑了 As part of this pull request, I've considered the following:

  • 已经仔细查看过代码改动的对比 Already check the difference between PR and old code
  • 代码风格正确，包括缩进空格，命名及其他风格 Style guide is adhered to, including spacing, naming and other styles
  • 没有垃圾代码，代码尽量精简，不包含#if 0代码，不包含已经被注释了的代码 All redundant code is removed and cleaned up
  • 所有变更均有原因及合理的，并且不会影响到其他软件组件代码或BSP All modifications are justified and not affect other components or BSP
  • 对难懂代码均提供对应的注释 I've commented appropriately where code is tricky
  • 代码是高质量的 Code in this PR is of high quality
  • 已经使用clang-format 源码格式化工具确保格式符合RT-Thread代码规范 This PR has been formatted with clang-format and complies with RT-Thread code specification
  • 如果是新增bsp, 已经添加ci检查到.github/ALL_BSP_COMPILE.json 详细请参考链接BSP自查

@usualtreee
[dhcp] fix raw server option bounds checks
1639035 
Validate option headers and declared lengths before walking or returning options. Check minimum value sizes at the MESSAGE_TYPE and REQUESTED_IP call sites and bound parsing by the received packet length.

Fixes: RT-Thread#11913
@github-actions

github-actions Bot commented Oct 28, 2026

Copy link
Copy Markdown

👋 感谢您对 RT-Thread 的贡献！Thank you for your contribution to RT-Thread!

为确保代码符合 RT-Thread 的编码规范，请在你的仓库中执行以下步骤运行代码格式化工作流（如果格式化CI运行失败）。
To ensure your code complies with RT-Thread's coding style, please run the code formatting workflow by following the steps below (If the formatting of CI fails to run).

🛠 操作步骤 | Steps

  1. 前往 Actions 页面 | Go to the Actions page
    点击进入工作流 → | Click to open workflow →

  2. 点击 Run workflow | Click Run workflow

  • Use workflow from 保持默认分支（通常为 master）
    Keep the default branch (usually master) in Use workflow from
  • 在 branch 输入框填写 PR 分支 fix/dhcpd-raw-option-bounds
    Enter PR branch fix/dhcpd-raw-option-bounds in the branch field
  • 设置需排除的文件/目录（目录请以"/"结尾）
    Set files/directories to exclude (directories should end with "/")
  1. 等待工作流完成 | Wait for the workflow to complete
    格式化后的代码将作为独立提交推送至你的分支。
    The formatting changes will be pushed to your branch as a separate commit.

完成后，提交将自动更新至 fix/dhcpd-raw-option-bounds 分支，关联的 Pull Request 也会同步更新。
Once completed, commits will be pushed to the fix/dhcpd-raw-option-bounds branch automatically, and the related Pull Request will be updated.

如有问题欢迎联系我们，再次感谢您的贡献！💐
If you have any questions, feel free to reach out. Thanks again for your contribution!

@github-actions

github-actions Bot commented Oct 28, 2026

Copy link
Copy Markdown

📌 Code Review Assignment

🏷️ Tag: components

Reviewers: @Maihuanyi

Changed Files (Click to expand)
  • components/net/lwip-dhcpd/dhcp_server_raw.c

📊 Current Review Status (Last Updated: 2026-10-28 16:42 CST)

📝 Review Instructions

  1. 维护者可以通过单击此处来刷新审查状态: 🔄 刷新状态
    Maintainers can refresh the review status by clicking here: 🔄 Refresh Status

  2. 确认审核通过后评论 LGTM/lgtm
    Comment LGTM/lgtm after confirming approval

  3. PR合并前需至少一位维护者确认
    PR must be confirmed by at least one maintainer before merging

ℹ️ 刷新CI状态操作需要具备仓库写入权限。
ℹ️ Refresh CI status operation requires repository Write permission.

@Rbb666
Rbb666 merged commit 30a61fe into RT-Thread:master Oct 28, 2026
4 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@Rbb666 Rbb666 Rbb666 approved these changes

Assignees

No one assigned

Labels

component: net Component

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

[Bug] raw-API DHCP server reads client option values without bounds checks (OOB read)

2 participants

@usualtreee @Rbb666