fix: V-001 security vulnerability

Automated security fix generated by Orbis Security AI
2026-05-26 05:45:48 +08:00 · 2026-05-07 05:37:15 +00:00
parent 479acdb47e
commit 49f985e0f6
1 changed files with 3 additions and 3 deletions
@@ -266,7 +266,7 @@ dhcp_alloc_again:
    {
        return NULL;
    }
-    SMEMCPY(node->chaddr, msg->chaddr, msg->hlen);
+    SMEMCPY(node->chaddr, msg->chaddr, (msg->hlen > sizeof(node->chaddr)) ? sizeof(node->chaddr) : msg->hlen);
    node->ipaddr = dhcpserver->current;

    node->next = dhcpserver->node_list;
@@ -731,10 +731,10 @@ void dhcpd_start(const char *netif_name)
        }
        p = p + 1; /* move to xxx.xxx.xxx.^ */

-        sprintf(p, "%d", DHCPD_CLIENT_IP_MIN);
+        snprintf(p, (size_t)(str_tmp + sizeof(str_tmp) - p), "%d", DHCPD_CLIENT_IP_MIN);
        ip4addr_aton(str_tmp, &ip_start);
        DEBUG_PRINTF("ip_start: [%s]\r\n", str_tmp);
-        sprintf(p, "%d", DHCPD_CLIENT_IP_MAX);
+        snprintf(p, (size_t)(str_tmp + sizeof(str_tmp) - p), "%d", DHCPD_CLIENT_IP_MAX);
        ip4addr_aton(str_tmp, &ip_end);
        DEBUG_PRINTF("ip_end: [%s]\r\n", str_tmp);