mirror of
https://github.com/openwrt/openwrt.git
synced 2026-10-19 22:25:39 +04:00
Hauke Mehrtens
13c493caba
6907f28f9dde dhcpv6: fix out-of-bounds read in self-loop detection memcmp f6571a42f24c dhcpv6: bound nested-relay recursion to HOP_COUNT_LIMIT 8637f4cbb15c dhcpv6: reject undersized encapsulated DHCPv4 messages in 4o6 path 14a85c979dd3 dhcpv4: honor Pad/End option encoding when iterating options 1c461b0c1dc5 ubus: drop spurious ntohl() of DHCPv4 lease IAID 6644b4623bc8 dhcpv6-ia: avoid undefined shifts in assign_pd() 41b476dffce6 netlink: avoid 32-bit-wide shift when computing /0 IPv4 netmask 355361356856 dhcpv4: never return NULL from dhcpv4_msg_to_string() 9c785500a990 ndp: enforce RFC4861 §7.1.1 hop-limit and ICMP-code checks on NS b1adea231412 dhcpv6: validate minimum length in relay_client_request() 0721ab6f06d6 config: guard captive_portal_uri parsing against strdup() failure 2db29c4eee32 dhcpv4: copy ifname into arpreq without reading past the source 28300477cf26 statefiles: skip dn_expand() when no search domain is configured 6545d3dba743 dhcpv6: avoid unaligned uint16_t reads in ORO option parsing f2cfc8dd4206 config: invert ipv6_pxe_from_uci() return value 909847c4054c dhcpv6-pxe: free previous default entry on replacement 94d97d101265 statefiles: clean up tmpfile error path 9054585fc868 dhcpv6: validate length and alignment when reading CLIENT_ARCH option 719fc3abc0d7 dhcpv6-ia: validate IA_NA/IA_PD option size before reading header 870699657afa config: bound DNR 'mandatory' SvcParam key count 9707cf72e5c9 router: restore upstream DNS/MTU between relayed RAs 8b02a78f879c router: keep RA DNS option lengths within the uint8 length field 48652c180adf dhcpv4: pass &dest.sin_addr to inet_ntop() when logging 538b626ddb95 dhcpv6: validate rewritten RELAY_MSG length in update_nested_message() 89d18771810b dhcpv6-ia: signal buffer-full from build_ia() IA_ADDR branch d168c27fb6a5 odhcpd: fix out-of-bounds write in build_ia d08dbcc527cb odhcpd: fix integer underflow in dhcpv6_ia_handle_IAs 6634b7a3c79c odhcpd: fix out of bounds write in dhcpv6_ia_handle_IAs 5b283832c0a7 dhcpv6-ia: avoid dangling first lease pointer 2a42d34c3615 dhcpv6-ia: fix Reconfigure Accept Auth option write offset Fixes: CVE-2026-53918 Fixes: CVE-2026-53921 Fixes: CVE-2026-53922 Link: https://github.com/openwrt/openwrt/pull/23868 Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>