dhcp/nettools: validate root-path option (17) to not contain any NUL characters

And make it UTF-8 (by backslash escaping).

1 files changed, 16 insertions, 5 deletions

diff --git a/src/core/dhcp/nm-dhcp-nettools.c b/src/core/dhcp/nm-dhcp-nettools.c
index 65095f0edb..a46e5430b3 100644
--- a/src/core/dhcp/nm-dhcp-nettools.c
+++ b/src/core/dhcp/nm-dhcp-nettools.c
@@ -928,11 +928,22 @@ lease_to_ip4_config(NMDedupMultiIndex *multi_idx,
     lease_parse_ntps(lease, options);
 
     r = n_dhcp4_client_lease_query(lease, NM_DHCP_OPTION_DHCP4_ROOT_PATH, &l_data, &l_data_len);
-    if (r == 0) {
-        nm_dhcp_option_add_option(options,
-                                  _nm_dhcp_option_dhcp4_options,
-                                  NM_DHCP_OPTION_DHCP4_ROOT_PATH,
-                                  g_strndup((char *) l_data, l_data_len));
+    if (r == 0 && nm_dhcp_lease_data_parse_cstr(l_data, l_data_len, &l_data_len)) {
+        /* https://tools.ietf.org/html/rfc2132#section-3.19
+         *
+         *   The path is formatted as a character string consisting of
+         *   characters from the NVT ASCII character set.
+         *
+         * We still accept any character set and backslash escape it! */
+        if (l_data_len == 0) {
+            /* "Its minimum length is 1." */
+        } else {
+            nm_dhcp_option_add_option_utf8safe_escape(options,
+                                                      _nm_dhcp_option_dhcp4_options,
+                                                      NM_DHCP_OPTION_DHCP4_ROOT_PATH,
+                                                      l_data,
+                                                      l_data_len);
+        }
     }
 
     r = n_dhcp4_client_lease_query(lease,