ppp: bound IPCP and IPV6CP packets by the received size

ipcp_recv() and ipv6cp_recv() only rejected packets whose header length
field was below PPP_HEADERLEN. The upper bound was missing, so the option
walker was handed a size derived purely from the peer chosen hdr->len.

ppp->buf is a fixed 8192 byte mempool block and ppp->buf_size holds the
number of bytes actually read, so a short frame declaring hdr->len 0xffff
made the option loop run off the end of the block: it kept fetching option
headers from whatever followed in the heap and stored pointers to them in
the ropt list. The read is harmless in itself but easily reaches unmapped
memory and kills the daemon.

Reject any packet whose declared length does not fit in what was received,
the way lcp_recv() and ccp_recv() already do. The two byte slack accounts
for the protocol field that precedes the header inside the buffer, and the
existing buf_size >= PPP_HEADERLEN + 2 test just above keeps the
subtraction from underflowing.

0 files changed, 0 insertions, 0 deletions