accel-ppp.git/accel-pppd/ctrl/pppoe, branch sstp-alloc-invariant

pppoe: fix use-after-free in mac_filter_load()

2026-07-06T08:28:53+00:00

When a mac-filter file line contained an octet > 255, the error path freed the entry but kept writing to it and linked it into mac_list. Validate all octets before allocating so invalid lines are skipped entirely. This is not considered a security vulnerability: the mac-filter file can only be configured by an administrator with access to the daemon config, or the CLI, both of which require privileged access. Fixes #307 Signed-off-by: Denys Fedoryshchenko

Merge pull request #323 from nuclearcat/stability-fixes

2026-06-23T15:58:26+00:00

Stability fixes

Merge pull request #315 from nuclearcat/khedor-fixes

2026-06-23T15:33:09+00:00

Several bugfixes for problems reported by Khodor Tahech

pppoe: handle missing service-name tag

2026-06-23T14:36:34+00:00

openssl: suppress deprecated API warnings

2026-06-10T18:28:29+00:00

Rejecting any PADR lacking a Service-Name tag (RFC 2516 compliance)

2026-05-29T05:58:41+00:00

Signed-off-by: Denys Fedoryshchenko

pppoe/disc: drop packets with unsupported PPPoE type

2026-05-23T08:41:36+00:00

The unsupported-PPPoE-type branch in disc_read() logs a warning but falls through to forward() instead of dropping the packet. Compare with the unsupported-version branch immediately above, which has the same shape but continues: if (hdr->ver != 1) { if (conf_verbose) log_warn(...unsupported version...); continue; } if (hdr->type != 1) { if (conf_verbose) log_warn(...unsupported type...); /* falls through into forward() */ } Add the missing continue so malformed packets are dropped instead of processed. Signed-off-by: khedor

pppoe/disc: fix free_net memmove count and overlap handling

2026-05-23T08:41:36+00:00

free_net() compacts the nets[] array by sliding entries left after removing one: memcpy(nets + i, nets + i + 1, net_cnt - i - 1); Two bugs: 1. The count is a raw element count, not a byte count. nets[] holds 'struct disc_net *' pointers, so only (net_cnt - i - 1) bytes are moved instead of (net_cnt - i - 1) * sizeof(nets[0]). On the usual 8-byte-pointer build, 7 of every 8 surviving pointers are lost, leaving uninitialised holes in the array. 2. Source and destination overlap (nets + i and nets + i + 1), so memcpy is undefined behaviour. The correct primitive is memmove. Switch to memmove and multiply the count by sizeof(nets[0]). Signed-off-by: khedor

pppoe/disc: fix init_net allocation size

2026-05-23T08:41:36+00:00

In init_net(), the buffer for struct disc_net was sized as n = _malloc(sizeof(*net) + (HASH_BITS + 1) * sizeof(struct tree)); but 'net' is the const struct ap_net * argument, not the disc_net being allocated. sizeof(*net) is therefore sizeof(struct ap_net), which is substantially smaller than sizeof(struct disc_net). Every field of *n written past the ap_net-sized prefix (ctx, hnd, net, refs, etc.) lands in unallocated heap memory. Use sizeof(*n) so the allocation matches the actual destination type. Signed-off-by: khedor

strip: Fix invalid parsing

2026-05-21T12:50:42+00:00

strip() memmove count was one short, dropping the NULL terminator; dpado_parse error path leaked already-parsed range entries. Also affects ipoe. Since strip is identical in both, we can place fixed common function in utils. Reported-by: Khedor Signed-off-by: Denys Fedoryshchenko