defense in depth: verify hex.DecodeString length

related to #49
2020-05-27 09:50:04 +02:00 · 2020-05-27 09:50:04 +02:00 · 4a5f55a5de
commit 4a5f55a5de
parent ead58ad72c
1 changed files with 4 additions and 0 deletions
--- a/internal/dhcp4d/dhcp4d.go
+++ b/internal/dhcp4d/dhcp4d.go
@ -255,6 +255,10 @@ func (h *Handler) leasePeriodForDevice(hwAddr string) time.Duration {
 	if err != nil {
 		return h.LeasePeriod
 	}
+	if len(hwAddrPrefix) != 6 {
+		// Invalid MAC address
+		return h.LeasePeriod
+	}
 	hwAddrPrefix = hwAddrPrefix[:3]
 	i := sort.Search(len(nintendoMacPrefixes), func(i int) bool {
 		return bytes.Compare(nintendoMacPrefixes[i][:], hwAddrPrefix) >= 0