Add bounds checks to netlink and DHCP parsers — prevent exception flood on malformed packets

presence/presence_daemon.py

@@ -412,6 +412,10 @@ def parse_netlink(data: bytes) -> None:
             if nlmsg_len < 16:
                 break
 
+            # Verify complete message is available before extracting payload
+            if offset + nlmsg_len > len(data):
+                return
+
             payload = data[offset + 16:offset + nlmsg_len]
 
             if nlmsg_type in (RTM_NEWNEIGH, RTM_DELNEIGH):
@@ -439,6 +443,10 @@ def parse_ndmsg(data: bytes, msg_type: int) -> None:
             if rta_len < 4:
                 break
 
+            # Verify complete RTA attribute is available before extracting
+            if offset + rta_len > len(data):
+                return
+
             val = data[offset + 4:offset + rta_len]
 
             if rta_type == NDA_LLADDR and len(val) == 6:
@@ -518,6 +526,8 @@ def parse_dhcp(data: bytes) -> None:
             return
 
         # MAC address (chaddr at offset 28, 6 bytes)
+        if len(dhcp) < 34:
+            return
         mac_bytes = dhcp[28:34]
         mac = ':'.join(f'{b:02x}' for b in mac_bytes)
         if mac in ('00:00:00:00:00:00', 'ff:ff:ff:ff:ff:ff'):