slirp: check len against dhcp options array end

[qemu.git] / slirp / bootp.c

diff --git a/slirp/bootp.c b/slirp/bootp.c
index 5a4646c1821dec66a28b1b5fe3ad4738a684cec8..5dd1a415b59c5abb78808c4e0d966230ef057ccc 100644 (file)
--- a/slirp/bootp.c
+++ b/slirp/bootp.c
@@ -123,6 +123,9 @@ static void dhcp_decode(const struct bootp_t *bp, int *pmsg_type,
             if (p >= p_end)
                 break;
             len = *p++;
+            if (p + len > p_end) {
+                break;
+            }
             DPRINTF("dhcp: tag=%d len=%d\n", tag, len);
 
             switch(tag) {