diff options
author | David Hankins <dhankins@isc.org> | 2008-06-11 20:17:10 +0000 |
---|---|---|
committer | David Hankins <dhankins@isc.org> | 2008-06-11 20:17:10 +0000 |
commit | 40ec5f386362ba9aa07827eac78d079024fcba5f (patch) | |
tree | 1630bbc913e91b00b2f6ef0256959e90317f61fd /client | |
parent | 420d8b3f0cecfc774ce9c46747ed5a2fb1ff8b5c (diff) | |
download | isc-dhcp-40ec5f386362ba9aa07827eac78d079024fcba5f.tar.gz |
- A double-dereference in dhclient transmission of DHCPDECLINEs was
repaired. [ISC-Bugs #18097]
Diffstat (limited to 'client')
-rw-r--r-- | client/dhclient.c | 7 |
1 files changed, 5 insertions, 2 deletions
diff --git a/client/dhclient.c b/client/dhclient.c index 5674a341..54e971cc 100644 --- a/client/dhclient.c +++ b/client/dhclient.c @@ -2432,12 +2432,13 @@ void make_decline (client, lease) struct option_state *options = (struct option_state *)0; + /* Create the options cache. */ oc = lookup_option (&dhcp_universe, lease -> options, DHO_DHCP_SERVER_IDENTIFIER); make_client_options(client, lease, &decline, oc, &lease->address, NULL, &options); - /* Set up the option buffer... */ + /* Consume the options cache into the option buffer. */ memset (&client -> packet, 0, sizeof (client -> packet)); client -> packet_length = cons_options ((struct packet *)0, &client -> packet, @@ -2445,10 +2446,12 @@ void make_decline (client, lease) (struct option_state *)0, options, &global_scope, 0, 0, 0, (struct data_string *)0, client -> config -> vendor_space_name); + + /* Destroy the options cache. */ option_state_dereference (&options, MDL); + if (client -> packet_length < BOOTP_MIN_LEN) client -> packet_length = BOOTP_MIN_LEN; - option_state_dereference (&options, MDL); client -> packet.op = BOOTREQUEST; client -> packet.htype = client -> interface -> hw_address.hbuf [0]; |