unsigned integer overflow in dhcp 154:36

[swirsz]

Crash discovered when fuzzing: fuzz_dhcp crash-ef4.txt

Input file ​ https://www.wirsz.com/script/crash-ef4.txt

dhcp.c:154:36: runtime error: unsigned integer overflow: 22 - 268 cannot be represented in type 'unsigned long'
SUMMARY: UndefinedBehaviorSanitizer? : undefined-behavior dhcp.c:154:36 in
Executed crash-ef4.txt in 0 ms

UBSan compiled from Github repository: November 14, 2021

[Gert Döring]

The "crash-ef4.txt" file referenced there seems to be a binary, not a .txt file?

That said, I wonder which code base this refers to. In openvpn "master", line 154 is

in_addr_t
dhcp_extract_router_msg(struct buffer *ipbuf)
{
    struct dhcp_full *df = (struct dhcp_full *) BPTR(ipbuf);
    const int optlen = BLEN(ipbuf) - (sizeof(struct openvpn_iphdr) + sizeof(struct openvpn_udphdr) + sizeof(struct dhcp));
 
    if (optlen >= 0

and optlen is a signed int type, as is BLEN(ipbuf) - so this seems to be all well defined signed-integer arithmetics, with a subsequent check for "was BLEN() too short?".

What am I overlooking here? Why does it want to represent anything in an "unsigned long"?

[Gert Döring]

No reply for 4 months, I can't do anything about this.