DHCP server crashed when receiving unknown option in Request

[Chinnapaiyan, Nagamani]

Hi,

We encountered a radiusd crash, when it received unknown option-145 in the Request packet(which is not defined in dictionary). Expected behavior is to ignore any unknown options and continue processing the packet.
Also please ensure(from code) radiusd is not crashing if the some known options are malformed in an incoming packet. Expected behavior is to ignore the packet and continue running.

Debug output: (seems crash is related to perl module)
(1470)  Tue Jun 30 06:21:11 2020 : Debug :   DHCP-Opcode = Client-Message
(1470)  Tue Jun 30 06:21:11 2020 : Debug :   DHCP-Hardware-Type = Ethernet
(1470)  Tue Jun 30 06:21:11 2020 : Debug :   DHCP-Hardware-Address-Length = 6
(1470)  Tue Jun 30 06:21:11 2020 : Debug :   DHCP-Hop-Count = 0
(1470)  Tue Jun 30 06:21:11 2020 : Debug :   DHCP-Transaction-Id = 376356509
(1470)  Tue Jun 30 06:21:11 2020 : Debug :   DHCP-Number-of-Seconds = 65535
(1470)  Tue Jun 30 06:21:11 2020 : Debug :   DHCP-Flags = 0
...
...
(1470)  Tue Jun 30 06:21:11 2020 : Debug :   DHCP-Hostname = "HP26D9AC"
(1470)  Tue Jun 30 06:21:11 2020 : Debug :   Attr-145 = 0x01
(1470)  Tue Jun 30 06:21:11 2020 : Debug :   DHCP-V-I-Vendor-Class = 0x0000000b024850
(1470)  Tue Jun 30 06:21:11 2020 : Debug :   DHCP-Parameter-Request-List = DHCP-Subnet-Mask
(1470)  Tue Jun 30 06:21:11 2020 : Debug :   DHCP-Parameter-Request-List = DHCP-Classless-Static-Route
(1470)  Tue Jun 30 06:21:11 2020 : Debug :   DHCP-Parameter-Request-List = DHCP-Static-Routes
...
...
...
(1470)  Tue Jun 30 06:21:11 2020 : Debug :   perl - &request:DHCP-Parameter-Request-List += $RAD_REQUEST{'DHCP-Parameter-Requ
est-List'} -> 'DHCP-Domain-Search'
(1470)  Tue Jun 30 06:21:11 2020 : Debug :   perl - &request:DHCP-Parameter-Request-List += $RAD_REQUEST{'DHCP-Parameter-Requ
est-List'} -> 'DHCP-Site-specific-28'
(1470)  Tue Jun 30 06:21:11 2020 : Debug :   perl - &request:DHCP-DHCP-Maximum-Msg-Size = $RAD_REQUEST{'DHCP-DHCP-Maximum-Msg
-Size'} -> '1500'
(1470)  Tue Jun 30 06:21:11 2020 : Debug :   perl - &request:DHCP-Server-IP-Address = $RAD_REQUEST{'DHCP-Server-IP-Address'}
-> '0.0.0.0'

(1470)  Tue Jun 30 06:21:11 2020 : Debug :   perl - &request:DHCP-V-I-Vendor-Class = $RAD_REQUEST{'DHCP-V-I-Vendor-Class'} -> ''

CONSISTENCY CHECK FAILED src/lib/util/pair.c[883]: VALUE_PAIR (raw/unknown) attribute 0x314a3a0 "Attr-145" data type incorrect.  Expected octets, got <INVALID>

ASSERT FAILED src/lib/util/pair.c[3050]: 0

CAUGHT SIGNAL: Aborted

Backtrace of last 18 frames:

/usr/lib64/freeradius/libfreeradius-util.so(fr_fault+0x1ae)[0x7f0aed10562e]

/usr/lib64/freeradius/libfreeradius-util.so(+0x148f9)[0x7f0aed1058f9]

/usr/lib64/freeradius/libfreeradius-util.so(fr_pair_verify+0x72d)[0x7f0aed11d60d]

/usr/lib64/freeradius/libfreeradius-util.so(fr_pair_add+0x27)[0x7f0aed11daf7]

/usr/lib64/freeradius/libfreeradius-util.so(fr_pair_make+0x148)[0x7f0aed11ea18]

/usr/lib64/freeradius/rlm_perl.so(+0x3169)[0x7f0ae3cb8169]

/usr/lib64/freeradius/rlm_perl.so(+0x33ec)[0x7f0ae3cb83ec]

/usr/lib64/freeradius/rlm_perl.so(+0x56f4)[0x7f0ae3cba6f4]

/usr/lib64/freeradius/libfreeradius-unlang.so(+0x118bc)[0x7f0aed58f8bc]

/usr/lib64/freeradius/libfreeradius-unlang.so(unlang_interpret+0x378)[0x7f0aed58c508]

/usr/lib64/freeradius/proto_dhcpv4_process.so(+0x156d)[0x7f0ae700e56d]

/usr/lib64/freeradius/libfreeradius-io.so(+0x14a83)[0x7f0aed36da83]

/usr/lib64/freeradius/libfreeradius-util.so(fr_event_service+0x23b)[0x7f0aed112bdb]

/usr/lib64/freeradius/libfreeradius-util.so(fr_event_loop+0x20)[0x7f0aed112fa0]

/usr/lib64/freeradius/libfreeradius-server.so(main_loop_start+0x4e)[0x7f0aed7e466e]

/usr/sbin/radiusd(main+0xe14)[0x404b64]

/lib64/libc.so.6(__libc_start_main+0xf5)[0x7f0aeb123555]

/usr/sbin/radiusd[0x405021]

No panic action set

After we added 145 in the dictionary, it started processing the request packet successfully.

Regards,
Nagamani Chinnapaiyan