diff options
| author | Denys Fedoryshchenko <denys.f@collabora.com> | 2026-02-06 18:02:00 +0200 |
|---|---|---|
| committer | Denys Fedoryshchenko <denys.f@collabora.com> | 2026-02-06 18:02:00 +0200 |
| commit | 96ff385e6b9084b4c6ba58292e396e18ff7d04d5 (patch) | |
| tree | 67f727d9b71a5476ddcde1ef9fb80ee7bd078c84 | |
| parent | 702eab1af49717924ba4009b89bbbeb9ed52066c (diff) | |
| download | accel-ppp-96ff385e6b9084b4c6ba58292e396e18ff7d04d5.tar.gz accel-ppp-96ff385e6b9084b4c6ba58292e396e18ff7d04d5.zip | |
radius: Vendor attribute parsing over-reads
When parsing vendor-specific attributes (type 26),
the code reads internal structure without checking that the attribute data is long enough.
Signed-off-by: Denys Fedoryshchenko <denys.f@collabora.com>
| -rw-r--r-- | accel-pppd/radius/packet.c | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/accel-pppd/radius/packet.c b/accel-pppd/radius/packet.c index aae2c6a1..339eac74 100644 --- a/accel-pppd/radius/packet.c +++ b/accel-pppd/radius/packet.c @@ -224,9 +224,17 @@ int rad_packet_recv(int fd, struct rad_packet_t **p, struct sockaddr_in *addr) goto out_err; } if (id == 26) { + if (len < 4) { + log_ppp_warn("radius:packet: vendor attribute too short (%i)\n", len); + goto out_err; + } vendor_id = ntohl(*(uint32_t *)ptr); vendor = rad_dict_find_vendor_id(vendor_id); if (vendor) { + if (len < 4 + vendor->tag + vendor->len) { + log_ppp_warn("radius:packet: vendor %i attribute too short (%i)\n", vendor_id, len); + goto out_err; + } ptr += 4; if (vendor->tag == 2) |