diff options
| author | Dmitry Kozlov <xeb@mail.ru> | 2015-01-09 21:07:17 +0300 |
|---|---|---|
| committer | Dmitry Kozlov <xeb@mail.ru> | 2015-01-09 21:07:17 +0300 |
| commit | 9db65ee7acc0e4a42c30250e728ab656e5a4c61a (patch) | |
| tree | f651db796b891f7060579e8f8e8fd238b26c6000 | |
| parent | 435e83d76b3058e91dcc7711e29d63a30f40a15c (diff) | |
| download | accel-ppp-9db65ee7acc0e4a42c30250e728ab656e5a4c61a.tar.gz accel-ppp-9db65ee7acc0e4a42c30250e728ab656e5a4c61a.zip | |
pppoe: check for tag length in print_packet function (fixes sigsegv)
| -rw-r--r-- | accel-pppd/ctrl/pppoe/pppoe.c | 11 |
1 files changed, 11 insertions, 0 deletions
diff --git a/accel-pppd/ctrl/pppoe/pppoe.c b/accel-pppd/ctrl/pppoe/pppoe.c index 12c274bb..092f0f32 100644 --- a/accel-pppd/ctrl/pppoe/pppoe.c +++ b/accel-pppd/ctrl/pppoe/pppoe.c @@ -487,6 +487,17 @@ static void print_packet(uint8_t *pack) for (n = 0; n < ntohs(hdr->length); n += sizeof(*tag) + ntohs(tag->tag_len)) { tag = (struct pppoe_tag *)(pack + ETH_HLEN + sizeof(*hdr) + n); + + if (n + sizeof(*tag) > ntohs(hdr->length)) { + log_info2(" ..."); + break; + } + + if (n + sizeof(*tag) + ntohs(tag->tag_len) > ntohs(hdr->length)) { + log_info2(" ..."); + break; + } + switch (ntohs(tag->tag_type)) { case TAG_END_OF_LIST: log_info2(" <End-Of-List>"); |