diff options
| -rw-r--r-- | accel-pppd/ctrl/pppoe/pppoe.c | 6 | ||||
| -rw-r--r-- | accel-pppd/ppp/ppp_lcp.c | 7 | ||||
| -rw-r--r-- | accel-pppd/triton/mempool.c | 2 |
3 files changed, 11 insertions, 4 deletions
diff --git a/accel-pppd/ctrl/pppoe/pppoe.c b/accel-pppd/ctrl/pppoe/pppoe.c index bd92cbf8..6161cc03 100644 --- a/accel-pppd/ctrl/pppoe/pppoe.c +++ b/accel-pppd/ctrl/pppoe/pppoe.c @@ -1156,6 +1156,7 @@ static void pppoe_recv_PADR(struct pppoe_serv_t *serv, uint8_t *pack, int size) struct pppoe_tag *service_name_tag = NULL; struct pppoe_tag *tr101_tag = NULL; int n, service_match = 0; + int service_name_count = 0; struct pppoe_conn_t *conn; int vendor_id; uint16_t ppp_max_payload = 0; @@ -1204,6 +1205,7 @@ static void pppoe_recv_PADR(struct pppoe_serv_t *serv, uint8_t *pack, int size) goto padr_tags_done; case TAG_SERVICE_NAME: service_name_tag = tag; + service_name_count++; if (tag->tag_len == 0) service_match = 1; else if (conf_service_name[0]) { @@ -1251,9 +1253,9 @@ padr_tags_done: return; } - if (!service_name_tag) { + if (service_name_count != 1) { if (conf_verbose) - log_warn("pppoe: discard PADR packet (no Service-Name tag present)\n"); + log_warn("pppoe: discard PADR packet (expected exactly one Service-Name tag)\n"); return; } diff --git a/accel-pppd/ppp/ppp_lcp.c b/accel-pppd/ppp/ppp_lcp.c index 2424ca94..4af28dd0 100644 --- a/accel-pppd/ppp/ppp_lcp.c +++ b/accel-pppd/ppp/ppp_lcp.c @@ -634,7 +634,10 @@ static void lcp_recv_echo_repl(struct ppp_lcp_t *lcp, uint8_t *data, int size) static void send_echo_reply(struct ppp_lcp_t *lcp) { struct lcp_hdr_t *hdr = (struct lcp_hdr_t*)lcp->ppp->buf; - //uint32_t magic = *(uint32_t *)(hdr + 1); + uint16_t len = ntohs(hdr->len); + + if (len > lcp->ppp->mtu) + return; lcp->echo_sent = 0; lcp->last_echo_ts = _time(); @@ -646,7 +649,7 @@ static void send_echo_reply(struct ppp_lcp_t *lcp) if (conf_ppp_verbose) log_ppp_debug("send [LCP EchoRep id=%x <magic %08x>]\n", hdr->id, lcp->magic); - ppp_chan_send(lcp->ppp, hdr, min(ntohs(hdr->len), lcp->ppp->mtu) + 2); + ppp_chan_send(lcp->ppp, hdr, len + 2); } static void send_echo_request(struct triton_timer_t *t) diff --git a/accel-pppd/triton/mempool.c b/accel-pppd/triton/mempool.c index a3c72dae..c37b66da 100644 --- a/accel-pppd/triton/mempool.c +++ b/accel-pppd/triton/mempool.c @@ -162,6 +162,8 @@ void __export mempool_free(void *ptr) it->magic1 = 0; #endif + memset(it->ptr, 0, p->size); + spin_lock(&p->lock); #ifdef MEMDEBUG list_del(&it->entry); |