dhcp: fix memory corruption when LWIP_DHCP_MAX_DNS_SERVERS > DNS_MAX_…

…SERVERS see patch #10124
lwip-tcpip · Oct 12, 2023 · 1eeb70f · 1eeb70f
1 parent b9ca1de
commit 1eeb70f
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/src/core/ipv4/dhcp.c b/src/core/ipv4/dhcp.c
@@ -1600,7 +1600,7 @@ dhcp_parse_reply(struct pbuf *p, struct dhcp *dhcp)
         /* special case: there might be more than one server */
         LWIP_DHCP_INPUT_ERROR("len %% 4 == 0", len % 4 == 0, return ERR_VAL;);
         /* limit number of DNS servers */
-        decode_len = LWIP_MIN(len, 4 * DNS_MAX_SERVERS);
+        decode_len = LWIP_MIN(len, 4 * LWIP_DHCP_PROVIDE_DNS_SERVERS);
         LWIP_DHCP_INPUT_ERROR("len >= decode_len", len >= decode_len, return ERR_VAL;);
         decode_idx = DHCP_OPTION_IDX_DNS_SERVER;
         break;