diff options
| author | Denys Fedoryshchenko <denys.f@collabora.com> | 2026-08-11 21:29:49 +0300 |
|---|---|---|
| committer | Denys Fedoryshchenko <denys.f@collabora.com> | 2026-08-11 21:29:49 +0300 |
| commit | 86e71f2aa48d62e1c63253f0986d5f643410a263 (patch) | |
| tree | fd1939f06f5da367d8f7a59de0a36298848c5621 | |
| parent | c32518d76569d833b0470633426ebd1f1cf029f4 (diff) | |
| download | accel-ppp-86e71f2aa48d62e1c63253f0986d5f643410a263.tar.gz accel-ppp-86e71f2aa48d62e1c63253f0986d5f643410a263.zip | |
pppoe: check for a truncated tag header in PADI
The PADI tag loop read tag_len before checking that the tag header itself
fits into the declared payload length, so a PADI ending with a partial tag
made it read up to 2 bytes past the receive buffer. print_packet() and the
PADR loop already have this check, add the missing one.
| -rw-r--r-- | accel-pppd/ctrl/pppoe/pppoe.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/accel-pppd/ctrl/pppoe/pppoe.c b/accel-pppd/ctrl/pppoe/pppoe.c index d5896a59..72faab4e 100644 --- a/accel-pppd/ctrl/pppoe/pppoe.c +++ b/accel-pppd/ctrl/pppoe/pppoe.c @@ -1043,6 +1043,8 @@ static void pppoe_recv_PADI(struct pppoe_serv_t *serv, uint8_t *pack, int size) len = ntohs(hdr->length); for (n = 0; n < len; n += sizeof(*tag) + ntohs(tag->tag_len)) { tag = (struct pppoe_tag *)(pack + ETH_HLEN + sizeof(*hdr) + n); + if (n + sizeof(*tag) > len) + return; if (n + sizeof(*tag) + ntohs(tag->tag_len) > len) return; switch (ntohs(tag->tag_type)) { |