diff --git a/src/libsystemd-network/dhcp-message.c b/src/libsystemd-network/dhcp-message.c index ae12c5b46a9..a3ba05688df 100644 --- a/src/libsystemd-network/dhcp-message.c +++ b/src/libsystemd-network/dhcp-message.c @@ -1409,12 +1409,19 @@ int dhcp_message_parse( r = tlv_parse(&message->options, &IOVEC_MAKE(message->header.file, sizeof(message->header.file))); if (r < 0) return r; + + /* The content of the overloaded field has been merged into options. Clear it so that the + * field is not re-parsed (which would duplicate the options) and not re-emitted verbatim + * by dhcp_message_build(), ensuring parse/build is idempotent. */ + memzero(message->header.file, sizeof(message->header.file)); } if (FLAGS_SET(overload, DHCP_OVERLOAD_SNAME)) { r = tlv_parse(&message->options, &IOVEC_MAKE(message->header.sname, sizeof(message->header.sname))); if (r < 0) return r; + + memzero(message->header.sname, sizeof(message->header.sname)); } *ret = TAKE_PTR(message); diff --git a/test/fuzz/fuzz-dhcp-client/overload-file-roundtrip b/test/fuzz/fuzz-dhcp-client/overload-file-roundtrip new file mode 100644 index 00000000000..43cee115a2e Binary files /dev/null and b/test/fuzz/fuzz-dhcp-client/overload-file-roundtrip differ