Uploaded image for project: 'OpenNMS'
  1. OpenNMS
  2. NMS-9420

No bounds-checking in processing of DHCP Options

    Details

    • Sprint:
      Horizon - September 6th

      Description

      User reports the following messages in dhcpd.log:

      2017-05-30 14:43:08,512 WARN  [DHCPReceiver] o.o.n.d.Receiver: An error occurred when reading DHCP response. Ignoring exception:
      java.lang.ArrayIndexOutOfBoundsException: 312
              at edu.bucknell.net.JDHCP.DHCPOptions.internalize(DHCPOptions.java:120) ~[jdhcp-1.1.1.jar:?]
              at edu.bucknell.net.JDHCP.DHCPMessage.internalize(DHCPMessage.java:423) ~[jdhcp-1.1.1.jar:?]
              at edu.bucknell.net.JDHCP.DHCPMessage.<init>(DHCPMessage.java:242) ~[jdhcp-1.1.1.jar:?]
              at org.opennms.netmgt.dhcpd.Receiver.run(Receiver.java:134) [org.opennms.protocols.dhcp-2016.1.3.jar:?]
              at java.lang.Thread.run(Thread.java:745) [?:1.8.0_92]
      

      I tracked down a copy of the jdhcp-1.1.1 source code and found that the DHCPOptions class' internalize method does no bounds checking.

      The jDHCP project looks orphaned; should we consider adopting it and implementing some defensive code here? Or can we handle the exception gracefully on our side?

        Attachments

          Activity

            People

            • Assignee:
              ranger Benjamin Reed
              Reporter:
              jeffg Jeff Gehlbach
            • Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

              Dates

              • Created:
                Updated:
                Resolved: