diff options
| author | Denys Fedoryshchenko <denys.f@collabora.com> | 2026-07-06 13:36:46 +0300 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2026-07-06 13:36:46 +0300 |
| commit | f4014a4a2c9e654646faeb81cd9ac5841b1c9b0f (patch) | |
| tree | 558b008fa888339f5e3ab396644971ef6dea8316 | |
| parent | 6db993d970dff69fe73672d2ad64df9f39b498fc (diff) | |
| parent | 2ba4437b88dc54ebc5dea6ba1c2007b9cd4aa0e0 (diff) | |
| download | accel-ppp-f4014a4a2c9e654646faeb81cd9ac5841b1c9b0f.tar.gz accel-ppp-f4014a4a2c9e654646faeb81cd9ac5841b1c9b0f.zip | |
Merge pull request #327 from nuclearcat/mac-filter-uaf-fix
pppoe: fix use-after-free in mac_filter_load()
| -rw-r--r-- | accel-pppd/ctrl/pppoe/mac_filter.c | 16 |
1 files changed, 9 insertions, 7 deletions
diff --git a/accel-pppd/ctrl/pppoe/mac_filter.c b/accel-pppd/ctrl/pppoe/mac_filter.c index ba78df6b..3a6a00d6 100644 --- a/accel-pppd/ctrl/pppoe/mac_filter.c +++ b/accel-pppd/ctrl/pppoe/mac_filter.c @@ -92,15 +92,17 @@ static int mac_filter_load(const char *opt) log_warn("pppoe: mac-filter:%s:%i: address is invalid\n", name, line); continue; } - mac = _malloc(sizeof(*mac)); for (i = 0; i < ETH_ALEN; i++) { - if (n[i] > 255) { - log_warn("pppoe: mac-filter:%s:%i: address is invalid\n", name, line); - _free(mac); - continue; - } - mac->addr[i] = n[i]; + if (n[i] > 255) + break; } + if (i < ETH_ALEN) { + log_warn("pppoe: mac-filter:%s:%i: address is invalid\n", name, line); + continue; + } + mac = _malloc(sizeof(*mac)); + for (i = 0; i < ETH_ALEN; i++) + mac->addr[i] = n[i]; list_add_tail(&mac->entry, &mac_list); } pthread_rwlock_unlock(&lock); |