<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=Content-Type content="text/html; charset=us-ascii">
<META content="MSHTML 6.00.2900.2802" name=GENERATOR></HEAD>
<BODY>
<DIV><FONT face=Arial size=2><SPAN class=970552208-08032006>Hi Fab,
</SPAN></FONT></DIV>
<DIV><FONT face=Arial size=2><SPAN
class=970552208-08032006></SPAN></FONT> </DIV>
<DIV><FONT face=Arial><FONT size=2><FONT><SPAN class=970552208-08032006>While
reading the code of the function </SPAN></FONT>__send_mgr_filter_dhcp<SPAN
class=970552208-08032006> I got to think that there might be a problem of a
possible buffer overrun caused by the loop:</SPAN></FONT></FONT></DIV>
<DIV><FONT face=Arial><FONT size=2><SPAN
class=970552208-08032006></SPAN></FONT></FONT> </DIV>
<DIV><FONT face=Arial><FONT size=2><SPAN class=970552208-08032006> while(
*p_option != DHCP_OPT_END )<BR> {<BR> switch( *p_option
)<BR> {<BR> case
DHCP_OPT_PAD:<BR> p_option++;<BR> break;</SPAN></FONT></FONT></DIV>
<DIV> </DIV>
<DIV><FONT face=Arial><FONT size=2><SPAN
class=970552208-08032006> case DHCP_OPT_MSG:<BR> msg
= p_option[2];<BR> p_option +=
3;<BR> break;</SPAN></FONT></FONT></DIV>
<DIV> </DIV>
<DIV><FONT face=Arial><FONT size=2><SPAN
class=970552208-08032006> case
DHCP_OPT_CLIENT_ID:<BR> p_cid =
p_option;<BR> /* Fall through. */</SPAN></FONT></FONT></DIV>
<DIV> </DIV>
<DIV><FONT face=Arial><FONT size=2><SPAN
class=970552208-08032006> default:<BR> /*<BR>
* All other options have a length byte following the option
code.<BR> * Offset by the length to get to the next
option.<BR> */<BR> p_option += (p_option[1] +
2);<BR> }<BR> }<BR>Please note that the loop assumes that the
buffer will contain the needed data to stop, however, the size of the packet is
not checked, and therefore the loop can continue passed the buffer size causing
a potential blue screen.</SPAN></FONT></FONT></DIV>
<DIV><FONT face=Arial><FONT size=2><SPAN
class=970552208-08032006></SPAN></FONT></FONT> </DIV>
<DIV><FONT face=Arial><FONT size=2><SPAN
class=970552208-08032006></SPAN></FONT></FONT> </DIV>
<DIV><FONT face=Arial><FONT size=2><SPAN class=970552208-08032006>A similar loop
exists in the function __recv_dhcp, probably with the same
problem.</SPAN></FONT></FONT></DIV>
<DIV><FONT face=Arial><FONT size=2><SPAN
class=970552208-08032006></SPAN></FONT></FONT> </DIV>
<DIV><FONT face=Arial><FONT size=2><SPAN class=970552208-08032006>Can you please
see if I there is indeed a problem in this lines?</SPAN></FONT></FONT></DIV>
<DIV><FONT face=Arial><FONT size=2><SPAN
class=970552208-08032006></SPAN></FONT></FONT> </DIV>
<DIV><FONT face=Arial><FONT size=2><SPAN
class=970552208-08032006>Thanks</SPAN></FONT></FONT></DIV>
<DIV><FONT face=Arial><FONT size=2><SPAN
class=970552208-08032006>Tzachi</SPAN></FONT></FONT></DIV></BODY></HTML>