pptp: reject control messages shorter than the header

PPTP_CTRL_SIZE() evaluates to 0 for unrecognised control types, so a
message declaring length 0 with such a type passed the length check,
reached process_packet() and was logged as unknown, after which
in_size -= 0 consumed nothing. The stale header stayed at the head of
the buffer and every later byte queued behind it, so the connection
could never make progress: it stalled until in_size reached
PPTP_CTRL_SIZE_MAX, at which point read() was called with a zero-length
buffer, returned 0 and was misreported as "disconnect by peer".

Require the declared length to cover the header, alongside the existing
upper bound.

1 files changed, 4 insertions, 0 deletions

diff --git a/accel-pppd/ctrl/pptp/pptp.c b/accel-pppd/ctrl/pptp/pptp.c
index 232c9fb5..b323dba6 100644
--- a/accel-pppd/ctrl/pptp/pptp.c
+++ b/accel-pppd/ctrl/pptp/pptp.c
@@ -567,6 +567,10 @@ static int pptp_read(struct triton_md_handler_t *h)
 				log_ppp_error("pptp: invalid magic\n");
 				goto drop;
 			}
+			if (ntohs(hdr->length) < sizeof(*hdr)) {
+				log_ppp_error("pptp: message is too short\n");
+				goto drop;
+			}
 			if (ntohs(hdr->length) >= PPTP_CTRL_SIZE_MAX) {
 				log_ppp_error("pptp: message is too long\n");
 				goto drop;