Uploaded image for project: 'OpenNMS'
  1. OpenNMS
  2. NMS-9420

No bounds-checking in processing of DHCP Options

    XMLWordPrintable

    Details

    • Sprint:
      Horizon - September 6th

      Description

      User reports the following messages in dhcpd.log:

      2017-05-30 14:43:08,512 WARN  [DHCPReceiver] o.o.n.d.Receiver: An error occurred when reading DHCP response. Ignoring exception:
      java.lang.ArrayIndexOutOfBoundsException: 312
              at edu.bucknell.net.JDHCP.DHCPOptions.internalize(DHCPOptions.java:120) ~[jdhcp-1.1.1.jar:?]
              at edu.bucknell.net.JDHCP.DHCPMessage.internalize(DHCPMessage.java:423) ~[jdhcp-1.1.1.jar:?]
              at edu.bucknell.net.JDHCP.DHCPMessage.<init>(DHCPMessage.java:242) ~[jdhcp-1.1.1.jar:?]
              at org.opennms.netmgt.dhcpd.Receiver.run(Receiver.java:134) [org.opennms.protocols.dhcp-2016.1.3.jar:?]
              at java.lang.Thread.run(Thread.java:745) [?:1.8.0_92]
      

      I tracked down a copy of the jdhcp-1.1.1 source code and found that the DHCPOptions class' internalize method does no bounds checking.

      The jDHCP project looks orphaned; should we consider adopting it and implementing some defensive code here? Or can we handle the exception gracefully on our side?

        Attachments

          Activity

            People

            Assignee:
            ranger Benjamin Reed
            Reporter:
            jeffg Jeff Gehlbach
            Votes:
            0 Vote for this issue
            Watchers:
            2 Start watching this issue

              Dates

              Created:
              Updated:
              Resolved: