Merge pull request #352 from nuclearcat/stability-fixes

Stability fixes and function unification

2 files changed, 4 insertions, 8 deletions

diff --git a/accel-pppd/ctrl/pppoe/pppoe.c b/accel-pppd/ctrl/pppoe/pppoe.c
index 0cc23180..0e65168d 100644
--- a/accel-pppd/ctrl/pppoe/pppoe.c
+++ b/accel-pppd/ctrl/pppoe/pppoe.c
@@ -24,6 +24,7 @@
 #endif
 
 #include "iputils.h"
+#include "utils.h"
 #include "connlimit.h"
 #include "vlan_mon.h"
 
@@ -33,10 +34,6 @@
 
 #define SID_MAX 65536
 
-#ifndef min
-#define min(x,y) ((x)<(y)?(x):(y))
-#endif
-
 struct pppoe_conn_t {
 	struct list_head entry;
 	struct triton_context_t ctx;
@@ -792,7 +789,7 @@ static int add_tag2(uint8_t *pack, size_t pack_size, const struct pppoe_tag *t)
 {
 	struct pppoe_hdr *hdr = (struct pppoe_hdr *)(pack + ETH_HLEN);
 	struct pppoe_tag *tag = (struct pppoe_tag *)(pack + ETH_HLEN + sizeof(*hdr) + ntohs(hdr->length));
-	if (pack_size <= ETH_HLEN + sizeof(*hdr) + ntohs(hdr->length) + ntohs(t->tag_len) || ntohs(t->tag_len) < 0)
+	if (pack_size <= ETH_HLEN + sizeof(*hdr) + ntohs(hdr->length) + sizeof(*t) + ntohs(t->tag_len))
 		return -1;
 
 	memcpy(tag, t, sizeof(*t) + ntohs(t->tag_len));
@@ -1043,6 +1040,8 @@ static void pppoe_recv_PADI(struct pppoe_serv_t *serv, uint8_t *pack, int size)
 	len = ntohs(hdr->length);
 	for (n = 0; n < len; n += sizeof(*tag) + ntohs(tag->tag_len)) {
 		tag = (struct pppoe_tag *)(pack + ETH_HLEN + sizeof(*hdr) + n);
+		if (n + sizeof(*tag) > len)
+			return;
 		if (n + sizeof(*tag) + ntohs(tag->tag_len) > len)
 			return;
 		switch (ntohs(tag->tag_type)) {
diff --git a/accel-pppd/ctrl/sstp/sstp.c b/accel-pppd/ctrl/sstp/sstp.c
index db08ae93..c3cd111d 100644
--- a/accel-pppd/ctrl/sstp/sstp.c
+++ b/accel-pppd/ctrl/sstp/sstp.c
@@ -50,9 +50,6 @@
 #include "sstp_prot.h"
 #include "if_ppposeq.h"
 
-#ifndef min
-#define min(x,y) ((x) < (y) ? (x) : (y))
-#endif
 #ifndef max
 #define max(x,y) ((x) > (y) ? (x) : (y))
 #endif