dhcp client had a segfault, when DHCP message contained 'pad' option.
The parsing logic kept checking for other options beyond __pad__ option, without
checking if it was __end__ option after that or not.
diff --git a/toys/pending/dhcp.c b/toys/pending/dhcp.c
index f93c940..2b432cb 100644
--- a/toys/pending/dhcp.c
+++ b/toys/pending/dhcp.c
@@ -1101,7 +1101,10 @@
}
while (*optptr != DHCP_OPTION_END) {
- while (*optptr == DHCP_OPTION_PADDING) optptr++;
+ if (*optptr == DHCP_OPTION_PADDING) {
+ optptr++;
+ continue;
+ }
if (*optptr == DHCP_OPTION_OVERLOAD) {
overloaded = optptr[2];
optptr += optptr[1] + 2;