Code: valid_length(uint8_t option, int dl, int *type)
{
 const struct dhcp_opt *opt;
 ssize_t sz;

 if (dl == 0)
 return -1;

 for (opt = dhcp_opts; opt->option; opt++) {
 if (opt->option != option)
 continue;

 
 		if (type)
 			*type = opt->type;
 		if (opt->type == 0 ||
 		    opt->type & (STRING | RFC3442 | RFC5969))
 			return 0;
 		sz = 0;
		if (opt->type & (UINT32 | IPV4))
 			sz = sizeof(uint32_t);
		if (opt->type & UINT16)
 			sz = sizeof(uint16_t);
		if (opt->type & UINT8)
 			sz = sizeof(uint8_t);
		if (opt->type & (IPV4 | ARRAY))
			return dl % sz;
		return (dl == sz ? 0 : -1);
 	}
 
 	/* unknown option, so let it pass */
 return 0;
}

Vulnerability Type: DoS Exec Code Overflow 
CWE ID: CWE-119
Summary: dhcpcd before 6.10.0, as used in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01 and other products, mismanages option lengths, which allows remote attackers to execute arbitrary code or cause a denial of service (heap-based buffer overflow) via a malformed DHCP response, aka internal bug 26461634.
Commit Message: Improve length checks in DHCP Options parsing of dhcpcd.

Bug: 26461634
Change-Id: Ic4c2eb381a6819e181afc8ab13891f3fc58b7deb
