تحلیل آسیب‌پذیری CVE-2026-42511

				
					func BuildResponse(req *Packet, cfg *Config, msgType byte, yiaddr net.IP) ([]byte, error) {
    serverIP := parseIPv4(cfg.ServerIP)
    subnetMask := parseIPv4(cfg.SubnetMask)
    nextServer := parseIPv4(cfg.NextServer)
    if nextServer == nil {
        nextServer = serverIP
    }

    if serverIP == nil || subnetMask == nil {
        return nil, fmt.Errorf("server_ip/subnet_mask invalid")
    }

    buf := make([]byte, fixedHeaderLen)

    buf[0] = 2 // BOOTREPLY
    buf[1] = req.HType
    buf[2] = req.HLen
    buf[3] = 0
    copy(buf[4:8], req.XID[:])
    binary.BigEndian.PutUint16(buf[8:10], 0)
    binary.BigEndian.PutUint16(buf[10:12], req.Flags)

    if yiaddr4 := yiaddr.To4(); yiaddr4 != nil {
        copy(buf[16:20], yiaddr4)
    }
    copy(buf[20:24], nextServer.To4())

    if req.GIAddr != nil {
        copy(buf[24:28], req.GIAddr.To4())
    }

    copy(buf[28:44], zeroPad(req.CHAddr, 16))
    copyFixedString(buf[44:108], cfg.SName)
    copyFixedString(buf[108:236], cfg.File)

    buf = append(buf, magicCookie...)

    var err error

    buf, err = appendOptionByte(buf, OptMessageType, msgType)
    if err != nil {
        return nil, err
    }
    buf, err = appendOptionIP(buf, OptServerID, serverIP)
    if err != nil {
        return nil, err
    }

    // A NAK usually only needs message type and server identifier.
    if msgType != DHCPNak {
        buf, err = appendOptionUint32(buf, OptLeaseTime, cfg.LeaseSeconds)
        if err != nil {
            return nil, err
        }
        buf, err = appendOptionIP(buf, OptSubnetMask, subnetMask)
        if err != nil {
            return nil, err
        }

        if cfg.Router != "" {
            if router := parseIPv4(cfg.Router); router != nil {
                buf, err = appendOptionIP(buf, OptRouter, router)
                if err != nil {
                    return nil, err
                }
            }
        }

        if len(cfg.DNSServers) > 0 {
            dns := make([]net.IP, 0, len(cfg.DNSServers))
            for _, s := range cfg.DNSServers {
                if ip := parseIPv4(s); ip != nil {
                    dns = append(dns, ip)
                }
            }
            if len(dns) > 0 {
                buf, err = appendOptionIPs(buf, OptDNSServer, dns)
                if err != nil {
                    return nil, err
                }
            }
        }

        buf, err = appendOptionString(buf, OptDomainName, cfg.DomainName)
        if err != nil {
            return nil, err
        }
        buf, err = appendOptionUint32(buf, OptRenewalTime, cfg.RenewalSeconds)
        if err != nil {
            return nil, err
        }
        buf, err = appendOptionUint32(buf, OptRebindingTime, cfg.RebindingSeconds)
        if err != nil {
            return nil, err
        }

        // PXE / boot-related DHCP options.
        buf, err = appendOptionString(buf, OptTFTPServerName, cfg.TFTPServerName)
        if err != nil {
            return nil, err
        }
        buf, err = appendOptionString(buf, OptBootfileName, cfg.BootFileName)
        if err != nil {
            return nil, err
        }

        for _, opt := range cfg.CustomOptions {
            value, err := opt.Bytes()
            if err != nil {
                return nil, err
            }
            buf, err = appendOption(buf, opt.Code, value)
            if err != nil {
                return nil, err
            }
        }
    }

    buf = append(buf, OptEnd)

    // Many clients tolerate shorter DHCP packets, but BOOTP/DHCP packets are
    // commonly padded to at least 300 bytes.
    for len(buf) < minBOOTPSize {
        buf = append(buf, 0)
    }

    return buf, nil
}