Skip to content

[components][lwip] DHCP 服务器解析选项时检查缓冲区边界 - #11858

Open
cms19859230182-lang wants to merge 2 commits into
RT-Thread:masterfrom
cms19859230182-lang:fix-11323-dhcp-bounds
Open

[components][lwip] DHCP 服务器解析选项时检查缓冲区边界#11858
cms19859230182-lang wants to merge 2 commits into
RT-Thread:masterfrom
cms19859230182-lang:fix-11323-dhcp-bounds

Conversation

@cms19859230182-lang

@cms19859230182-lang cms19859230182-lang commented Oct 8, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

拉取/合并请求描述：(PR description)

[

为什么提交这份PR (why to submit this PR)

Fixes #11323

components/net/lwip-dhcpd/dhcp_server.c 解析 DHCP 选项时，while (finished == 0) 按选项长度往前走，不看 recvfrom 实际收到的字节数。畸形包会越界读。

你的解决方案是什么 (what is your solution)

用 bytes_read 作为缓冲区末尾。读选项类型和长度之前至少要剩下 2 字节；选项内容也必须落在已收到的字节里，不够就停。请求 IP 的长度不足 4、消息类型的长度不足 1 时，不再按固定偏移去读。长度合法的包，解析结果和原来一样。

END（0xFF）按协议只有 1 字节，没有长度字段。原代码会读它后面的那一字节当长度。这次在后面没有字节时直接停，不再越界；已经解析到的字段保留。

改动按审核建议拆成两笔提交：

  1. [components][lwip] dhcpd: check buffer bounds when parsing options：只包含上面的边界检查。
  2. [components][lwip] dhcpd: apply clang-format to dhcp_server.c：只用仓库根目录的 .clang-format（clang-format 19.1.7）格式化整个文件。除了给 4 处单语句补上大括号，不改变任何逻辑。

请提供验证的bsp和config (provide the config and bsp)

  • BSP: 未上板。改动不依赖具体板卡，打开 DHCP 服务器后用畸形选项包即可打到这条路径。
  • .config: LWIP_USING_DHCPD
  • action:

]

当前拉取/合并请求的状态 Intent for your PR

必须选择一项 Choose one (Mandatory):

  • 本拉取/合并请求是一个草稿版本 This PR is for a code-review and is intended to get feedback
  • 本拉取/合并请求是一个成熟版本 This PR is mature, and ready to be integrated into the repo

代码质量 Code Quality：

我在这个拉取/合并请求中已经考虑了 As part of this pull request, I've considered the following:

  • 已经仔细查看过代码改动的对比 Already check the difference between PR and old code
  • 代码风格正确，包括缩进空格，命名及其他风格 Style guide is adhered to, including spacing, naming and other styles
  • 没有垃圾代码，代码尽量精简，不包含#if 0代码，不包含已经被注释了的代码 All redundant code is removed and cleaned up
  • 所有变更均有原因及合理的，并且不会影响到其他软件组件代码或BSP All modifications are justified and not affect other components or BSP
  • 对难懂代码均提供对应的注释 I've commented appropriately where code is tricky
  • 代码是高质量的 Code in this PR is of high quality
  • 已经使用clang-format 源码格式化工具确保格式符合RT-Thread代码规范 This PR has been formatted with clang-format and complies with RT-Thread code specification
  • 如果是新增bsp, 已经添加ci检查到.github/ALL_BSP_COMPILE.json 详细请参考链接BSP自查

@github-actions

github-actions Bot commented Oct 8, 2026

Copy link
Copy Markdown

👋 感谢您对 RT-Thread 的贡献！Thank you for your contribution to RT-Thread!

为确保代码符合 RT-Thread 的编码规范，请在你的仓库中执行以下步骤运行代码格式化工作流（如果格式化CI运行失败）。
To ensure your code complies with RT-Thread's coding style, please run the code formatting workflow by following the steps below (If the formatting of CI fails to run).

🛠 操作步骤 | Steps

  1. 前往 Actions 页面 | Go to the Actions page
    点击进入工作流 → | Click to open workflow →

  2. 点击 Run workflow | Click Run workflow

  • Use workflow from 保持默认分支（通常为 master）
    Keep the default branch (usually master) in Use workflow from
  • 在 branch 输入框填写 PR 分支 fix-11323-dhcp-bounds
    Enter PR branch fix-11323-dhcp-bounds in the branch field
  • 设置需排除的文件/目录（目录请以"/"结尾）
    Set files/directories to exclude (directories should end with "/")
  1. 等待工作流完成 | Wait for the workflow to complete
    格式化后的代码将作为独立提交推送至你的分支。
    The formatting changes will be pushed to your branch as a separate commit.

完成后，提交将自动更新至 fix-11323-dhcp-bounds 分支，关联的 Pull Request 也会同步更新。
Once completed, commits will be pushed to the fix-11323-dhcp-bounds branch automatically, and the related Pull Request will be updated.

如有问题欢迎联系我们，再次感谢您的贡献！💐
If you have any questions, feel free to reach out. Thanks again for your contribution!

@github-actions

github-actions Bot commented Oct 8, 2026 •
edited
Loading

Copy link
Copy Markdown

📌 Code Review Assignment

🏷️ Tag: components

Reviewers: @Maihuanyi

Changed Files (Click to expand)
  • components/net/lwip-dhcpd/dhcp_server.c

📊 Current Review Status (Last Updated: 2026-10-09 11:18 CST)

📝 Review Instructions

  1. 维护者可以通过单击此处来刷新审查状态: 🔄 刷新状态
    Maintainers can refresh the review status by clicking here: 🔄 Refresh Status

  2. 确认审核通过后评论 LGTM/lgtm
    Comment LGTM/lgtm after confirming approval

  3. PR合并前需至少一位维护者确认
    PR must be confirmed by at least one maintainer before merging

ℹ️ 刷新CI状态操作需要具备仓库写入权限。
ℹ️ Refresh CI status operation requires repository Write permission.

@aozima aozima self-assigned this Oct 8, 2026
@github-actions

github-actions Bot commented Oct 8, 2026 •
edited
Loading

Copy link
Copy Markdown

MemBrowse Memory Report

No memory changes detected for:

@Rbb666

Rbb666 commented Oct 9, 2026 •
edited
Loading

Copy link
Copy Markdown
Member

建议拆成两笔 commit，方便审核和合并，分别是改动主体和格式化

@cms19859230182-lang

cms19859230182-lang commented Oct 9, 2026

Copy link
Copy Markdown
Contributor Author

好的

@cms19859230182-lang
[components][lwip] dhcpd: check buffer bounds when parsing options
79876c9 
The option loop advanced by the option length without checking the
number of bytes actually received by recvfrom(), so a malformed or
truncated DHCP packet could make the server read past the end of the
receive buffer.

Check that the option type, length and payload stay inside the received
data before reading them, and stop parsing when a requested IP option
is shorter than 4 bytes or a message type option is shorter than 1 byte.

Fixes RT-Thread#11323
@cms19859230182-lang
[components][lwip] dhcpd: apply clang-format to dhcp_server.c
752bd6b

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

@aozima aozima

Labels

component: net Component

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

DHCP server unbounded option parsing - OOB read from packet buffer

3 participants

@cms19859230182-lang @Rbb666 @aozima