[git commit] udhcpc: check read of overload option data byte to be within packet

[Denys Vlasenko]

commit: https://git.busybox.net/busybox/commit/?id=f11c6989ba40f6bed8c4b4f0b6b7578aba3a63f9
branch: https://git.busybox.net/busybox/commit/?id=refs/heads/master

function                                             old     new   delta
udhcp_get_option                                     220     225      +5

Signed-off-by: Denys Vlasenko <vda.linux at googlemail.com>
---
 networking/udhcp/common.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/networking/udhcp/common.c b/networking/udhcp/common.c
index 589bcd6..1aaf525 100644
--- a/networking/udhcp/common.c
+++ b/networking/udhcp/common.c
@@ -268,7 +268,8 @@ uint8_t* FAST_FUNC udhcp_get_option(struct dhcp_packet *packet, int code)
 		}
 
 		if (optionptr[OPT_CODE] == DHCP_OPTION_OVERLOAD) {
-			overload |= optionptr[OPT_DATA];
+			if (len >= 3)
+				overload |= optionptr[OPT_DATA];
 			/* fall through */
 		}
 		optionptr += len;