check_dhcp: Fix handling of "pad" options

Don't let "pad" options[*] terminate the parsing of DHCP options.  This
bug was triggered by using check_dhcp against Windows 2003 DHCP servers
(see #3503921).

[*] Cf. RFC 2132, 3.1.

1 files changed, 4 insertions, 3 deletions

diff --git a/plugins-root/check_dhcp.c b/plugins-root/check_dhcp.c
index 2a1875c..ac89274 100644
--- a/plugins-root/check_dhcp.c
+++ b/plugins-root/check_dhcp.c
@@ -839,8 +839,7 @@ int add_dhcp_offer(struct in_addr source,dhcp_packet *offer_packet){
         /* process all DHCP options present in the packet */
         for(x=4;x<MAX_DHCP_OPTIONS_LENGTH;){
 
-                /* end of options (0 is really just a pad, but bail out anyway) */
-                if((int)offer_packet->options[x]==-1 || (int)offer_packet->options[x]==0)
+                if((int)offer_packet->options[x]==-1)
                         break;
 
                 /* get option type */
@@ -872,7 +871,9 @@ int add_dhcp_offer(struct in_addr source,dhcp_packet *offer_packet){
                         }
 
                 /* skip option data we're ignoring */
-                if(option_type!=DHCP_OPTION_REBINDING_TIME)
+                if(option_type==0) /* "pad" option, see RFC 2132 (3.1) */
+                        x+=1;
+                else
                         x+=option_length;
                 }