accel-ppp.git/accel-pppd/ctrl, branch sstp-alloc-invariant

sstp: express escape buffer bound as one invariant

2026-07-26T08:19:24+00:00

(size + PPP_FCSLEN) * 2 + 2 equals 8b781b94's size*2 + 2 + PPP_FCSLEN*2 but can't collapse back to the 1801847a under-allocating form.

ipoe: fix username string leak on early session teardown

2026-07-06T22:15:06+00:00

The ipoe-level ses->username always holds an allocated string (_strdup of ifname/calling-station-id, u_inet_ntoa buffer or lua result), but ipoe_session_free() never released it. Ownership is normally transferred in auth_result() via ap_session_set_username(), so the string was leaked whenever a session died before auth_result() ran: termination while starting, PWDB_WAIT never completing, or ipoe_create_interface() failure. The create-interface failure path also leaked the freshly allocated local copy outright, since it returned before the string was stored anywhere. Store the string in ses->username as soon as it is obtained and free it in ipoe_session_free(). auth_result() clears ses->username before handing ownership to ap_session_set_username(), so no double free is possible. Reported-by: Louis Scalbert (#101)

ipoe: fix dhcpv4 relay reply packet leak

2026-07-06T22:15:06+00:00

dhcpv4_relay_read() takes a reference on the reply packet for every registered listener context and hands it over via triton_context_call(). The receiving ipoe_ses_recv_dhcpv4_relay() consumes that reference by storing the packet in ses->dhcpv4_relay_reply, but the early-return branch taken when the original request is already gone dropped the reference without freeing the packet. This leaks one packet every time a relay reply races with the request being released, which happens regularly on busy relay-mode deployments. Reported-by: Louis Scalbert (#101)

pppoe: fix use-after-free in mac_filter_load()

2026-07-06T08:28:53+00:00

When a mac-filter file line contained an octet > 255, the error path freed the entry but kept writing to it and linked it into mac_list. Validate all octets before allocating so invalid lines are skipped entirely. This is not considered a security vulnerability: the mac-filter file can only be configured by an administrator with access to the daemon config, or the CLI, both of which require privileged access. Fixes #307 Signed-off-by: Denys Fedoryshchenko

Merge pull request #323 from nuclearcat/stability-fixes

2026-06-23T15:58:26+00:00

Stability fixes

Merge pull request #315 from nuclearcat/khedor-fixes

2026-06-23T15:33:09+00:00

Several bugfixes for problems reported by Khodor Tahech

sstp: drain PPP write queue before deferring

2026-06-23T14:36:34+00:00

pppoe: handle missing service-name tag

2026-06-23T14:36:34+00:00

sstp: reserve escaped async PPP FCS space

2026-06-23T14:36:34+00:00

openssl: suppress deprecated API warnings

2026-06-10T18:28:29+00:00