From 6fa5ebc506fc75fa2398e10ad2506dedf70d44d6 Mon Sep 17 00:00:00 2001 From: Luca Boccassi Date: Mon, 18 May 2026 12:05:10 +0100 Subject: [PATCH] dhcp-client: reject messages larger than the maximum UDP payload dhcp_message_verify_header() only enforced a lower bound on the input length, so dhcp_message_parse() happily accepted arbitrarily large buffers. Such inputs could never have been received via UDP and would later fail in dhcp_message_build() with -E2BIG once the parsed options' combined size exceeds UDP_PAYLOAD_MAX_SIZE, which the fuzzer surfaced as an assertion failure. Reject inputs above UDP_PAYLOAD_MAX_SIZE up front, so the parse stage mirrors what the wire format can actually carry. Follow-up for 8c18bb6547c2138f2f17b921ec06f2c1f7cd17cd Fixes https://github.com/systemd/systemd/issues/42147 Co-developed-by: Claude Opus 4.7 --- src/libsystemd-network/dhcp-message.c | 5 +++++ test/fuzz/fuzz-dhcp-client/oversized-message | Bin 0 -> 69627 bytes 2 files changed, 5 insertions(+) create mode 100644 test/fuzz/fuzz-dhcp-client/oversized-message diff --git a/src/libsystemd-network/dhcp-message.c b/src/libsystemd-network/dhcp-message.c index bf85dd4233..14671a0750 100644 --- a/src/libsystemd-network/dhcp-message.c +++ b/src/libsystemd-network/dhcp-message.c @@ -1342,6 +1342,11 @@ static int dhcp_message_verify_header( if (iov->iov_len < sizeof(DHCPMessageHeader)) return -EBADMSG; + /* DHCP travels over UDP, so anything larger than the maximum UDP payload cannot be a valid + * message and would also be impossible to rebuild as a UDP packet. */ + if (iov->iov_len > UDP_PAYLOAD_MAX_SIZE) + return -EBADMSG; + const DHCPMessageHeader *header = iov->iov_base; if (!IN_SET(header->op, BOOTREQUEST, BOOTREPLY)) diff --git a/test/fuzz/fuzz-dhcp-client/oversized-message b/test/fuzz/fuzz-dhcp-client/oversized-message new file mode 100644 index 0000000000000000000000000000000000000000..a1b3f69aa864c382061683d99be179cbbac37ec7 GIT binary patch literal 69627 zcmeG_e{2=UncwWL4X+sR(Oe}%tFu$8n1^wn{cOj9B*vklBvAkh(pV5w8;8~eiXk|C zHgZC)Jw?hz>iLRVR6%jh{Be91}k~`H>t2T<%NR*s((ut;r+FW#((x|;0fwS5B zzL}l#cWoW@l$-zWKgyzF(`cdcdTm;o6FIpQBS9f7vH4nY!8k(6)}w z>_?cs^U+7Y|AbD0iEgFpP3Bzd<;;i7o6UJs+MDG$dgfO^+ug-r^x4l-j#3Z)OiH=j zE&ktpf67jHVWXL00LvFJy`gCazXyQc;MeX%uX7omFwIL@y?^9edqxg!)^5r)>?C@` z|KxI-Ga3MGIZYpabwp=y6=qjK1F)1nd~ig+ws#w>f?1yLfhKu*V)7IiOw$cuVCYYc zjZ@LXdg`7%cu#0yN}uRDMNNW{YreM*C*mn>*>b#{C;dsQ8Ol-rF8t;FfBNUld%wPa zzo<~m5hr&tr-{S!84b^%haY8Q<|p2TpEpqJki?PGunY4zdu|mn+D+X^vkI_dR?18KSJ!8i?Sk1ly zKiJ(brrte`r*&P^b$v+J;XmiC*MjG1G&TR2nkH+MHTZuTcPEuPsm|*2EwALujo^!? zh~;LQ9ZPAs$+;^qOjaU({rrekoSEorZw~FKH zpa0W8Yy(Gpyj{^AKE~Y@qiKUcHj)wpJYYTi<$PeST}Sv^ z?c!_%7iYs0-sPTtSgZX38rbQE9cg#EWTw-ZG#=9bHnf6Mc~P24r`z520_U=n8So!= z+w3&F%m0vjSO8)nC<|DFUlxtvolgatb1v8oQ(I%MgjJm0TJ^VB|1%ZnE%pEJmor)| zZ{u(4E?vUTy^soemJ7(6R`HwD1pN`uxB-=>0*5mkMUE0T4wZ2WXM!PV-Fn@0PWn$!Mol!joDPEMX0r41D z1M)!(pKuciA5sW>0^%ys4FkR~|B~3lA%Uw;J^JWr_~N6FK9%jvW;=o2NhI+`ysx2e zl!|(zK!+mU$QcFxz#s^o;X@QrD8?^wVJLXna90ra~tCd_S` ztDA$djDZ`Dx%SuRKJGIg_*Gv+AA1YT$%S(9y z<=mzIyPa}=mb9|-D0y36HXsC8T+k3zTI7_f8I$wkn$cx@A9r2#3j{cxYjoj@18@b} zVW8FGsGZ5eMl8@D3D&aCm+^D)*Lr=Xj#LINIHI680mE zn_YH(`a1`HYrY@3kw#cc%wd3m^Fz796A`5R284PGWUglA!3uznMw= zB0*}JbO?fXhCQ^FIc3Efdr_m9zasgl@z3FPE=&QE(SIUb*Syemeue&=}@yqb{gOsDt9#0@n}89o}pXQ=B+K~&JOK5^W!Ur zkHKMJ{|j}vL*|M+_8_qOZWL+VwVjyqQo$55Z6goAm7gKa1~3=#j;o^X(>&ej;H^BT8A3f`?O zts$wQb2MX!1%nzoowv0xe@5u%NJ$)Q3zv^~Pw{5*&(=OC{-8{qg@U{hb?GTqEzBHBpFJ8@b6sVw-C77JV2}{m7^F0B3U~TL?x5A zJ0dw-b&*FjRwFCDbfw8#xHcoyh&81(DVGf1nQA}93MWIcR4BHPgNQI;Nl0Op5MJ^m zN(i4HI@RuyC_y=Qmy)tn>3`{)+X8rsN^By@C@{$;GNUX^7R4qK*MWCa7fvF}%nK=X z4vH9*;ZqRus;gzh#b9p^?sNe{>D!9iysJ>!ohWH`N&DE?{Y~+OaRkGw%t1dg+tEU} zXykL0h-*8~SVX>%;Bz=x?wV_(S-gta(?a7o7&#$kA_5R2W5MVSrVnPx*lDXZdj-At}^z65#Qikl4;AE`GD z7^ydbH=yFdDb8e7Or(|jH)4*hAu=btZ1en_@k;Lf{iY**;b_Tfr-Cd^MYQAlJ5-L6{#Iv4q`=aF_iD(P)V6~*7Q{+=Qq`<+3;#Aj za?8M|_@j{@>tK;3p24y*OHdl9G~YD$i{* zNvNt6-+Tw63|E8J!%Fe36yKa~R74k|JO+uak{*L9?s*;`IC67Qitj)~xLW!sqEdY0 zf>w&}CiA77E3FUeTI3%G zD^ee%LhwlOvqH0+q4UY&tAS=!2p$!JXL29YhT7^N*Q|V}QAenZ=SUD+sFjim!J|U( zbY*sm&!_75vI@boG(zyWef?FKSHUJ% zdOy0@KUQ7jezc~HPzBoa9?{e^s{%ZZxQrQhA4MU8i1&y?<=a0-#NJ3O0IaSdn6gh) z_KBe|U0txmF4;bp6|sU+t{INcH=%#7@?>;h0vQJd@iON3F*s>a4e+SW2*2qo+ zT!U_=QDp2MW6#j7Y4g^Wb7zNko%!*V!^hz8VrO-0I51B&?GqnM_(|O*F5p%6iAYnG zePWc6Mf^@ll$L1U5wS-rUPy^~B>K~@~E=t_st##YJWuO!(K{iJzQf6krSOJ?Tu@u`jR7XN|7!zvi7Yks+ zRE#SXYeYAimw6#hW``5nso4BII zCYs*h_m$O03v6tzbR)sgdJ@VIaLVF1k z^zE?jUGCE4UrEs52&~mkK$AvBZaeTCpnY&~upK9N5MVR@?8MUg96+71;r{clT)ap< z7)wCUlzUyc<620B1(#b}L@C0-Fn-Q65T1dQA)nfL)ZXS zi2JydYb@gaBC$DS{QCqNw6w3^H~`B|UVKnX!{4B-#gQ-eKeVl*Gka!#$fbXrawiS_ z5-~ZAbaZx}+3%_|KQ*PXv;L%k|4N?x_s^bfimJkUARqa!^d^~X=8Wj2)xVK%?HLg- ziLWJI)kIUjvE$>1$BxkpQ0mukL=0;LmQe<}UFjC>%}nz~H~M1g1{cch9~&n{XJcgg zb4=6`etZ&7{%UFpy*Z&Rr|HA5j_3@o!t5$&0L$p*+TLxj3TAn}$EQQ(Po;jcarhi` z(Ai~p!Za^s_5Ka?f(JL>4C%<%jt+l4&abUo=bHw3^VF2M9q;BzXHO$s>G;FBUSXzm z_6X(a62Cy58+}HKd7-HVpry$zsgD;AwPdCDqUGwLd8#-f8V#x7gK z8(eSb-#C1%`TGnO=pip5Nc{-an@6!(Q6Zw7%wRX(0C<5MkJAQg26zXIfyVl2v*p%9 z^*h&OG_%wZT1xnjr)KLvKnsol zCL_(^4;eJE0NV7-Cc6Fxd=}Vu4d@v8mZNeWU8D19tB9pl#%w5Fw$1u*3kh< z;^fU^)`!0fSW&oGZ2{Nq^}$5yG}r$6+{b<91HbBP=wokzIXT+gk$Dda3uURit!vHO zx+=gMzb?YakRVY?FXyJ$a-4h;kXZ3Z-ok`aLkzvr%PGB_3aVZay&PZWWQ~ByWt>S_ zF8@vFASLgn`zX1Z`YOL5g~>eQl$Xm~51Un51w^^hieC(KU`Q$(_}ZG=z*9ZJ79=2e zYpF;EGcUjha+Zn@JK<2cM L&>-JUhv@YGYqh5v literal 0 HcmV?d00001