summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorDmitriy Eshenko <dmitriy.eshenko@accel-ppp.org>2024-03-21 07:46:15 +0300
committerGitHub <noreply@github.com>2024-03-21 07:46:15 +0300
commite897625e1794f16e4c64319e4c39bbafb0f81d16 (patch)
tree46453cc95ba697464e27f482fc9c29a3414a1bbd
parent827431d1b60bbd0ce140394e888b73d05f095ff1 (diff)
parent78db7640db0e2afa8403d721fd241ae901ba0bde (diff)
downloadaccel-ppp-e897625e1794f16e4c64319e4c39bbafb0f81d16.tar.gz
accel-ppp-e897625e1794f16e4c64319e4c39bbafb0f81d16.zip
Merge pull request #123 from nuclearcat/safeguards-gw-helpers
Add safeguards to parse_gw_ip_address helper functions
-rw-r--r--accel-pppd/extra/chap-secrets.c13
-rw-r--r--accel-pppd/extra/ippool.c3
2 files changed, 16 insertions, 0 deletions
diff --git a/accel-pppd/extra/chap-secrets.c b/accel-pppd/extra/chap-secrets.c
index 849ceef1..b486bb11 100644
--- a/accel-pppd/extra/chap-secrets.c
+++ b/accel-pppd/extra/chap-secrets.c
@@ -739,9 +739,22 @@ static void parse_gw_ip_address(const char *opt)
const char *ptr = strchr(opt, '/');
if (ptr) {
+ // safeguard, we don't want to overflow/underflow addr
+ if (ptr - opt > 16 || ptr - opt < 7) {
+ log_error("chap-secrets: invalid gw-ip-address %s\n", opt);
+ conf_gw_ip_address = 0;
+ conf_netmask = 0;
+ return;
+ }
memcpy(addr, opt, ptr - opt);
addr[ptr - opt] = 0;
conf_gw_ip_address = inet_addr(addr);
+ // safeguard, if / is the last character, then ptr + 1 == NULL
+ if (!ptr[1]) {
+ log_error("chap-secrets: invalid netmask %s\n", ptr);
+ conf_netmask = 32;
+ return;
+ }
conf_netmask = atoi(ptr + 1);
if (conf_netmask < 0 || conf_netmask > 32) {
log_error("chap-secrets: invalid netmask %i\n", conf_netmask);
diff --git a/accel-pppd/extra/ippool.c b/accel-pppd/extra/ippool.c
index 6ba2b5df..3ae48e95 100644
--- a/accel-pppd/extra/ippool.c
+++ b/accel-pppd/extra/ippool.c
@@ -108,6 +108,9 @@ static void parse_gw_ip_address(const char *val)
ptr = strchr(val, '/');
if (ptr) {
+ // safeguard, don't crash on oversized or undersized strings
+ if (ptr - val > 15 || ptr - val < 7)
+ return;
memcpy(addr, val, ptr - val);
addr[ptr - val] = 0;
conf_gw_ip_address = inet_addr(addr);