diff options
| author | Denys Fedoryshchenko <denys.f@collabora.com> | 2026-05-21 17:03:17 +0300 |
|---|---|---|
| committer | Denys Fedoryshchenko <denys.f@collabora.com> | 2026-05-21 17:03:17 +0300 |
| commit | 22c61e8e2e16ebe8e9576fe46487e3614982e8ac (patch) | |
| tree | 73f23e95ffc8e53058f7eec9a36e82cbfaa8d8f9 | |
| parent | 1b67ba0785a847eee6adb69b7e68995c33803805 (diff) | |
| download | accel-ppp-22c61e8e2e16ebe8e9576fe46487e3614982e8ac.tar.gz accel-ppp-22c61e8e2e16ebe8e9576fe46487e3614982e8ac.zip | |
fix: dict.c: split() could return 0, making dict_load read ptr[-1]
If a RADIUS dictionary contains a line consisting of exactly one
word with no trailing spaces (for example, standard keywords like
"END-VENDOR\n" or "END-TLV\n" ), this bug getting triggered.
Triggering crash is compiler dependent, it might not happen now,
but a bit different compiler, flags, and it might crash on load.
Reported-by: Khedor <khedor@gmail.com>
Signed-off-by: Denys Fedoryshchenko <denys.f@collabora.com>
| -rw-r--r-- | accel-pppd/radius/dict.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/accel-pppd/radius/dict.c b/accel-pppd/radius/dict.c index 145c5da2..c181c7cd 100644 --- a/accel-pppd/radius/dict.c +++ b/accel-pppd/radius/dict.c @@ -92,7 +92,7 @@ static int dict_load(const char *fname) continue; r = split(buf, ptr); - if (*ptr[r - 1] == '#') + if (r > 0 && *ptr[r - 1] == '#') r--; if (!strcmp(buf, "VENDOR")) { |