diff options
| author | Denys Fedoryshchenko <denys.f@collabora.com> | 2026-08-11 21:29:49 +0300 |
|---|---|---|
| committer | Denys Fedoryshchenko <denys.f@collabora.com> | 2026-08-11 21:29:49 +0300 |
| commit | 86e71f2aa48d62e1c63253f0986d5f643410a263 (patch) | |
| tree | fd1939f06f5da367d8f7a59de0a36298848c5621 /accel-pppd/ctrl/ipoe | |
| parent | c32518d76569d833b0470633426ebd1f1cf029f4 (diff) | |
| download | accel-ppp-86e71f2aa48d62e1c63253f0986d5f643410a263.tar.gz accel-ppp-86e71f2aa48d62e1c63253f0986d5f643410a263.zip | |
pppoe: check for a truncated tag header in PADI
The PADI tag loop read tag_len before checking that the tag header itself
fits into the declared payload length, so a PADI ending with a partial tag
made it read up to 2 bytes past the receive buffer. print_packet() and the
PADR loop already have this check, add the missing one.
Diffstat (limited to 'accel-pppd/ctrl/ipoe')
0 files changed, 0 insertions, 0 deletions