diff options
| author | Denys Fedoryshchenko <denys.f@collabora.com> | 2026-02-06 18:09:44 +0200 |
|---|---|---|
| committer | Denys Fedoryshchenko <denys.f@collabora.com> | 2026-02-06 18:09:44 +0200 |
| commit | e09b9c81d54c326c3eca2267d38d91db0ca93f8a (patch) | |
| tree | 4dce0370d64df4adc7e14309b4805968d6c10ef0 /accel-pppd | |
| parent | ee53459c7d09d7bcb2482ebead9a1d10f5ad7180 (diff) | |
| download | accel-ppp-e09b9c81d54c326c3eca2267d38d91db0ca93f8a.tar.gz accel-ppp-e09b9c81d54c326c3eca2267d38d91db0ca93f8a.zip | |
radius: Invalid integer and date parsing
Actually 3 fixes in same place:
INTEGER: size mismatch now breaks instead of falling through - a malformed INTEGER attribute is rejected rather than silently parsed with a wrong size
INTEGER/DATE split: each case has its own break, no more fallthrough
DATE: strictly requires len == 4 (per RFC 2865), warns and skips otherwise instead of silently accepting 1 or 2-byte dates
Signed-off-by: Denys Fedoryshchenko <denys.f@collabora.com>
Diffstat (limited to 'accel-pppd')
| -rw-r--r-- | accel-pppd/radius/packet.c | 11 |
1 files changed, 9 insertions, 2 deletions
diff --git a/accel-pppd/radius/packet.c b/accel-pppd/radius/packet.c index bf01bbdc..cfc0bc29 100644 --- a/accel-pppd/radius/packet.c +++ b/accel-pppd/radius/packet.c @@ -292,9 +292,10 @@ int rad_packet_recv(int fd, struct rad_packet_t **p, struct sockaddr_in *addr) attr->val.octets = ptr; break; case ATTR_TYPE_INTEGER: - if (len != da->size) + if (len != da->size) { log_ppp_warn("radius:packet: attribute %s has invalid length %i (must be %i)\n", da->name, len, da->size); - case ATTR_TYPE_DATE: + break; + } if (len == 4) attr->val.integer = ntohl(*(uint32_t*)ptr); else if (len == 2) @@ -302,6 +303,12 @@ int rad_packet_recv(int fd, struct rad_packet_t **p, struct sockaddr_in *addr) else if (len == 1) attr->val.integer = *ptr; break; + case ATTR_TYPE_DATE: + if (len == 4) + attr->val.integer = ntohl(*(uint32_t*)ptr); + else + log_ppp_warn("radius:packet: attribute %s has invalid length %i (must be 4)\n", da->name, len); + break; case ATTR_TYPE_IPADDR: case ATTR_TYPE_IFID: case ATTR_TYPE_IPV6ADDR: |