From ff46abe61f2e4d380a90d63617b002967bf8ffae Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Arnim=20L=C3=A4uger?= Date: Tue, 2 Aug 2016 22:30:11 +0200 Subject: [PATCH] Fix DHCP server heap corruption per recommendation by Espressif (#1421) To avoid crash in DHCP big packages modify option length from 312 to MTU - IPHEAD(20) - UDPHEAD(8) - DHCPHEAD(236). --- app/include/lwip/app/dhcpserver.h | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/app/include/lwip/app/dhcpserver.h b/app/include/lwip/app/dhcpserver.h index a4379a17..7983729f 100644 --- a/app/include/lwip/app/dhcpserver.h +++ b/app/include/lwip/app/dhcpserver.h @@ -1,6 +1,8 @@ #ifndef __DHCPS_H__ #define __DHCPS_H__ +#include "lwipopts.h" + #define USE_DNS typedef struct dhcps_state{ @@ -19,7 +21,9 @@ typedef struct dhcps_msg { uint8_t chaddr[16]; uint8_t sname[64]; uint8_t file[128]; - uint8_t options[312]; + // Recommendation from Espressif: + // To avoid crash in DHCP big packages modify option length from 312 to MTU - IPHEAD(20) - UDPHEAD(8) - DHCPHEAD(236). + uint8_t options[IP_FRAG_MAX_MTU - 20 - 8 - 236]; }dhcps_msg; #ifndef LWIP_OPEN_SRC