summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
Diffstat
-rw-r--r--accel-pppd/ctrl/ipoe/ipoe.c32
-rw-r--r--accel-pppd/ctrl/pppoe/disc.c5
-rw-r--r--accel-pppd/ctrl/pppoe/dpado.c33
-rw-r--r--accel-pppd/ctrl/pppoe/pppoe.c6
-rw-r--r--accel-pppd/radius/dict.c2
-rw-r--r--accel-pppd/utils.c11
-rw-r--r--accel-pppd/utils.h1
7 files changed, 53 insertions, 37 deletions
diff --git a/accel-pppd/ctrl/ipoe/ipoe.c b/accel-pppd/ctrl/ipoe/ipoe.c
index 5592845f..4bf43434 100644
--- a/accel-pppd/ctrl/ipoe/ipoe.c
+++ b/accel-pppd/ctrl/ipoe/ipoe.c
@@ -3574,19 +3574,6 @@ static void load_radius_attrs(void)
}
#endif
-static void strip(char *str)
-{
- char *ptr = str;
- char *endptr = strchr(str, 0);
- while (1) {
- ptr = strchr(ptr, ' ');
- if (ptr)
- memmove(ptr, ptr + 1, endptr - ptr - 1);
- else
- break;
- }
-}
-
int parse_offer_delay(const char *str)
{
char *str1;
@@ -3603,7 +3590,7 @@ int parse_offer_delay(const char *str)
return 0;
str1 = _strdup(str);
- strip(str1);
+ u_strstrip(str1, ' ');
ptr1 = str1;
@@ -3619,17 +3606,23 @@ int parse_offer_delay(const char *str)
memset(r, 0, sizeof(*r));
r->delay = strtol(ptr1, &endptr, 10);
- if (*endptr)
+ if (*endptr) {
+ _free(r);
goto out_err;
+ }
if (list_empty(&conf_offer_delay))
r->conn_cnt = 0;
else {
- if (!ptr3)
+ if (!ptr3) {
+ _free(r);
goto out_err;
+ }
r->conn_cnt = strtol(ptr3 + 1, &endptr, 10);
- if (*endptr)
+ if (*endptr) {
+ _free(r);
goto out_err;
+ }
}
list_add_tail(&r->entry, &conf_offer_delay);
@@ -3644,6 +3637,11 @@ int parse_offer_delay(const char *str)
return 0;
out_err:
+ while (!list_empty(&conf_offer_delay)) {
+ r = list_entry(conf_offer_delay.next, typeof(*r), entry);
+ list_del(&r->entry);
+ _free(r);
+ }
_free(str1);
log_error("ipoe: failed to parse offer-delay\n");
return -1;
diff --git a/accel-pppd/ctrl/pppoe/disc.c b/accel-pppd/ctrl/pppoe/disc.c
index e673a97a..f7f5c781 100644
--- a/accel-pppd/ctrl/pppoe/disc.c
+++ b/accel-pppd/ctrl/pppoe/disc.c
@@ -77,7 +77,7 @@ static struct disc_net *init_net(const struct ap_net *net)
fcntl(sock, F_SETFD, FD_CLOEXEC);
net->set_nonblocking(sock, 1);
- n = _malloc(sizeof(*net) + (HASH_BITS + 1) * sizeof(struct tree));
+ n = _malloc(sizeof(*n) + (HASH_BITS + 1) * sizeof(struct tree));
tree = n->tree;
for (i = 0; i <= HASH_BITS; i++) {
@@ -110,7 +110,7 @@ static void free_net(struct disc_net *net)
pthread_mutex_lock(&nets_lock);
for (i = 0; i < MAX_NET; i++) {
if (nets[i] == net) {
- memcpy(nets + i, nets + i + 1, net_cnt - i - 1);
+ memmove(nets + i, nets + i + 1, (net_cnt - i - 1) * sizeof(nets[0]));
net_cnt--;
break;
}
@@ -363,6 +363,7 @@ static int disc_read(struct triton_md_handler_t *h)
if (hdr->type != 1) {
if (conf_verbose)
log_warn("pppoe: discarding packet (unsupported type %i)\n", hdr->type);
+ continue;
}
if (forward(net, src.sll_ifindex, pack, n))
diff --git a/accel-pppd/ctrl/pppoe/dpado.c b/accel-pppd/ctrl/pppoe/dpado.c
index 351a43dc..dc570dda 100644
--- a/accel-pppd/ctrl/pppoe/dpado.c
+++ b/accel-pppd/ctrl/pppoe/dpado.c
@@ -11,6 +11,7 @@
#include "triton.h"
#include "log.h"
#include "memdebug.h"
+#include "utils.h"
#include "pppoe.h"
@@ -60,19 +61,6 @@ void dpado_check_prev(int conn_cnt)
pthread_mutex_unlock(&dpado_range_lock);
}
-static void strip(char *str)
-{
- char *ptr = str;
- char *endptr = strchr(str, 0);
- while (1) {
- ptr = strchr(ptr, ' ');
- if (ptr)
- memmove(ptr, ptr + 1, endptr - ptr - 1);
- else
- break;
- }
-}
-
int dpado_parse(const char *str)
{
char *str1 = _strdup(str);
@@ -81,7 +69,7 @@ int dpado_parse(const char *str)
LIST_HEAD(range_list);
struct dpado_range_t *r;
- strip(str1);
+ u_strstrip(str1, ' ');
ptr1 = str1;
@@ -97,17 +85,23 @@ int dpado_parse(const char *str)
memset(r, 0, sizeof(*r));
r->pado_delay = strtol(ptr1, &endptr, 10);
- if (*endptr)
+ if (*endptr) {
+ _free(r);
goto out_err;
+ }
if (list_empty(&range_list))
r->conn_cnt = INT_MAX;
else {
- if (!ptr3)
+ if (!ptr3) {
+ _free(r);
goto out_err;
+ }
r->conn_cnt = strtol(ptr3 + 1, &endptr, 10);
- if (*endptr)
+ if (*endptr) {
+ _free(r);
goto out_err;
+ }
}
list_add_tail(&r->entry, &range_list);
@@ -160,6 +154,11 @@ int dpado_parse(const char *str)
return 0;
out_err:
+ while (!list_empty(&range_list)) {
+ r = list_entry(range_list.next, typeof(*r), entry);
+ list_del(&r->entry);
+ _free(r);
+ }
_free(str1);
log_emerg("pppoe: pado_delay: invalid format\n");
return -1;
diff --git a/accel-pppd/ctrl/pppoe/pppoe.c b/accel-pppd/ctrl/pppoe/pppoe.c
index 93824af5..d543a129 100644
--- a/accel-pppd/ctrl/pppoe/pppoe.c
+++ b/accel-pppd/ctrl/pppoe/pppoe.c
@@ -1234,6 +1234,12 @@ padr_tags_done:
return;
}
+ if (!service_name_tag) {
+ if (conf_verbose)
+ log_warn("pppoe: discard PADR packet (no Service-Name tag present)\n");
+ return;
+ }
+
if (ntohs(ac_cookie_tag->tag_len) != COOKIE_LENGTH) {
if (conf_verbose)
log_warn("pppoe: discard PADR packet (incorrect AC-Cookie tag length)\n");
diff --git a/accel-pppd/radius/dict.c b/accel-pppd/radius/dict.c
index 145c5da2..c181c7cd 100644
--- a/accel-pppd/radius/dict.c
+++ b/accel-pppd/radius/dict.c
@@ -92,7 +92,7 @@ static int dict_load(const char *fname)
continue;
r = split(buf, ptr);
- if (*ptr[r - 1] == '#')
+ if (r > 0 && *ptr[r - 1] == '#')
r--;
if (!strcmp(buf, "VENDOR")) {
diff --git a/accel-pppd/utils.c b/accel-pppd/utils.c
index 018b6efa..f92ebe19 100644
--- a/accel-pppd/utils.c
+++ b/accel-pppd/utils.c
@@ -347,3 +347,14 @@ int __export u_randbuf(void *buf, size_t buf_len, int *err)
return 0;
}
+
+void __export u_strstrip(char *str, char c)
+{
+ char *src = str, *dst = str;
+ while (*src) {
+ if (*src != c)
+ *dst++ = *src;
+ src++;
+ }
+ *dst = '\0';
+}
diff --git a/accel-pppd/utils.h b/accel-pppd/utils.h
index 06859a6b..aad4025f 100644
--- a/accel-pppd/utils.h
+++ b/accel-pppd/utils.h
@@ -24,6 +24,7 @@ size_t u_parse_ip6cidr(const char *str, struct in6_addr *netp, uint8_t *plen);
size_t u_parse_ip4cidr(const char *str, struct in_addr *netp, uint8_t *plen);
size_t u_parse_ip4range(const char *str, struct in_addr *base_ip, uint8_t *max);
+void u_strstrip(char *str, char c);
int u_randbuf(void *buf, size_t buf_len, int *err);
#endif
generated by cgit v1.2.3 (git 2.39.1) at 2026-07-14 17:03:24 +0000