Merge branch 'fix/lwip_dhcps_oob_read_cleanup' into 'master'

[lwip]: dhcps oob read -- cleanup

See merge request espressif/esp-idf!47870

components/lwip/Kconfig

@@ -452,14 +452,6 @@ menu "LWIP"
                 Enabling this option allows DHCP server to support temporary static ARP entries
                 for DHCP Client. This will help the DHCP server to send the DHCP OFFER and DHCP ACK using IP unicast.
 
-        config LWIP_DHCPS_TEST_PARSE_OPTIONS
-            bool "Expose parse_options() for unit testing"
-            default n
-            depends on LWIP_DHCPS
-            help
-                Enables a non-static wrapper around the internal parse_options() function
-                so it can be called from test code. Only enable this for testing builds.
-
     endmenu # DHCPS
 
     menuconfig LWIP_AUTOIP

components/lwip/apps/dhcpserver/dhcpserver.c

@@ -1231,10 +1231,7 @@ static void handle_dhcp(void *arg,
     struct dhcps_t *dhcps = arg;
     struct dhcps_msg *pmsg_dhcps = NULL;
     u16_t tlen, malloc_len;
-    u16_t i;
-    u16_t dhcps_msg_cnt = 0;
     u8_t *p_dhcps_msg = NULL;
-    u8_t *data;
     s16_t state;
 
 #if DHCPS_DEBUG
@@ -1266,52 +1263,23 @@ static void handle_dhcp(void *arg,
 
     p_dhcps_msg = (u8_t *)pmsg_dhcps;
     tlen = p->tot_len;
-    data = p->payload;
 
 #if DHCPS_DEBUG
     DHCPS_LOG("dhcps: handle_dhcp-> p->tot_len = %d\n", tlen);
     DHCPS_LOG("dhcps: handle_dhcp-> p->len = %d\n", p->len);
 #endif
 
-    for (i = 0; i < p->len; i++) {
-        p_dhcps_msg[dhcps_msg_cnt++] = data[i];
-#if DHCPS_DEBUG
-        DHCPS_LOG("%02x ", data[i]);
-
-        if ((i + 1) % 16 == 0) {
-            DHCPS_LOG("\n");
-        }
-
-#endif
-    }
-
-    if (p->next != NULL) {
-#if DHCPS_DEBUG
-        DHCPS_LOG("dhcps: handle_dhcp-> p->next != NULL\n");
-        DHCPS_LOG("dhcps: handle_dhcp-> p->next->tot_len = %d\n", p->next->tot_len);
-        DHCPS_LOG("dhcps: handle_dhcp-> p->next->len = %d\n", p->next->len);
-#endif
-
-        data = p->next->payload;
-
-        for (i = 0; i < p->next->len; i++) {
-            p_dhcps_msg[dhcps_msg_cnt++] = data[i];
-#if DHCPS_DEBUG
-            DHCPS_LOG("%02x ", data[i]);
-
-            if ((i + 1) % 16 == 0) {
-                DHCPS_LOG("\n");
-            }
-
-#endif
-        }
+    if (tlen == 0 || pbuf_copy_partial(p, p_dhcps_msg, tlen, 0) != tlen) {
+        pbuf_free(p);
+        mem_free(pmsg_dhcps);
+        return;
     }
 
 #if DHCPS_DEBUG
     DHCPS_LOG("dhcps: handle_dhcp-> parse_msg(p)\n");
 #endif
 
-    state = parse_msg(dhcps, pmsg_dhcps, tlen - 240);
+    state = parse_msg(dhcps, pmsg_dhcps, tlen >= 240 ? (u16_t)(tlen - 240) : 0);
 #ifdef LWIP_HOOK_DHCPS_POST_STATE
     state = LWIP_HOOK_DHCPS_POST_STATE(pmsg_dhcps, malloc_len, state);
 #endif /* LWIP_HOOK_DHCPS_POST_STATE */
@@ -1731,7 +1699,7 @@ bool dhcps_get_hostname_on_mac(dhcps_t *dhcps, const u8_t *mac, char *out, size_
     return false;
 }
 #endif
-#ifdef CONFIG_LWIP_DHCPS_TEST_PARSE_OPTIONS
+#if LWIP_DHCPS_TEST_PARSE_OPTIONS == 1
 u8_t dhcps_test_parse_options(u8_t *optptr, s16_t len)
 {
     dhcps_t *dhcps = dhcps_new();
@@ -1743,6 +1711,6 @@ u8_t dhcps_test_parse_options(u8_t *optptr, s16_t len)
     mem_free(dhcps);
     return result;
 }
-#endif
+#endif /* LWIP_DHCPS_TEST_PARSE_OPTIONS == 1 */
 
 #endif // ESP_DHCPS

components/lwip/port/include/lwipopts.h

@@ -3,7 +3,7 @@
  *
  * SPDX-License-Identifier: BSD-3-Clause
  *
- * SPDX-FileContributor: 2015-2025 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileContributor: 2015-2026 Espressif Systems (Shanghai) CO LTD
  */
 #ifndef LWIP_HDR_ESP_LWIPOPTS_H
 #define LWIP_HDR_ESP_LWIPOPTS_H
@@ -1707,6 +1707,14 @@ static inline uint32_t timeout_from_offered(uint32_t lease, uint32_t min)
 #define ESP_DHCPS_TIMER                 0
 #endif /* CONFIG_LWIP_DHCPS */
 
+/**
+ * LWIP_DHCPS_TEST_PARSE_OPTIONS==1: Expose dhcps_test_parse_options() in dhcpserver.c for
+ * unit tests. Default 0. Test projects may set -DLWIP_DHCPS_TEST_PARSE_OPTIONS=1
+ * (e.g. from CMake via idf_build_set_property) — do not use Kconfig for this.
+ */
+#ifndef LWIP_DHCPS_TEST_PARSE_OPTIONS
+#define LWIP_DHCPS_TEST_PARSE_OPTIONS 0
+#endif
 
 #if LWIP_NETCONN_SEM_PER_THREAD
 #define LWIP_NETCONN_THREAD_SEM_GET() sys_thread_sem_get()

components/lwip/test_apps/CMakeLists.txt

@@ -5,4 +5,7 @@ set(EXTRA_COMPONENT_DIRS "$ENV{IDF_PATH}/tools/test_apps/components")
 set(COMPONENTS main)
 
 include($ENV{IDF_PATH}/tools/cmake/project.cmake)
+# Test-only: enable DHCP options parser test hook in lwip (set before project() so
+# all components pick up the compile definition; not in Kconfig)
+idf_build_set_property(COMPILE_DEFINITIONS "LWIP_DHCPS_TEST_PARSE_OPTIONS=1" APPEND)
 project(lwip_test)

components/lwip/test_apps/main/lwip_test.c

@@ -492,7 +492,7 @@ TEST(lwip, sntp_client_time_2048)
  * truncated, and malformed inputs.
  */
 
-#ifdef CONFIG_LWIP_DHCPS_TEST_PARSE_OPTIONS
+#if LWIP_DHCPS_TEST_PARSE_OPTIONS
 
 extern u8_t dhcps_test_parse_options(u8_t *optptr, s16_t len);
 
@@ -610,7 +610,7 @@ TEST(lwip, dhcps_parse_options_req_ipaddr_truncated)
     TEST_ASSERT(state != 0);
 }
 
-#endif /* CONFIG_LWIP_DHCPS_TEST_PARSE_OPTIONS */
+#endif /* LWIP_DHCPS_TEST_PARSE_OPTIONS */
 
 TEST_GROUP_RUNNER(lwip)
 {
@@ -621,7 +621,7 @@ TEST_GROUP_RUNNER(lwip)
     RUN_TEST_CASE(lwip, sntp_client_time_2015)
     RUN_TEST_CASE(lwip, sntp_client_time_2048)
     RUN_TEST_CASE(lwip, dhcp_arp_probe_self_mac_is_ok)
-#ifdef CONFIG_LWIP_DHCPS_TEST_PARSE_OPTIONS
+#if LWIP_DHCPS_TEST_PARSE_OPTIONS
     RUN_TEST_CASE(lwip, dhcps_parse_options_well_formed_discover)
     RUN_TEST_CASE(lwip, dhcps_parse_options_well_formed_request_ack)
     RUN_TEST_CASE(lwip, dhcps_parse_options_pad_bytes_skipped)

components/lwip/test_apps/sdkconfig.defaults

@@ -3,6 +3,3 @@ CONFIG_UNITY_ENABLE_IDF_TEST_RUNNER=n
 
 # Added to enable compilation of DHCP last IP restore feature
 CONFIG_LWIP_DHCP_RESTORE_LAST_IP=y
-
-# Expose DHCP server option parser for unit testing
-CONFIG_LWIP_DHCPS_TEST_PARSE_OPTIONS=y