4 files changed, 40 insertions, 36 deletions

diff --git a/accel-pppd/ctrl/ipoe/ipoe.c b/accel-pppd/ctrl/ipoe/ipoe.c
index 5592845f..4bf43434 100644
--- a/accel-pppd/ctrl/ipoe/ipoe.c
+++ b/accel-pppd/ctrl/ipoe/ipoe.c
@@ -3574,19 +3574,6 @@ static void load_radius_attrs(void)
 }
 #endif
 
-static void strip(char *str)
-{
-	char *ptr = str;
-	char *endptr = strchr(str, 0);
-	while (1) {
-		ptr = strchr(ptr, ' ');
-		if (ptr)
-			memmove(ptr, ptr + 1, endptr - ptr - 1);
-		else
-			break;
-	}
-}
-
 int parse_offer_delay(const char *str)
 {
 	char *str1;
@@ -3603,7 +3590,7 @@ int parse_offer_delay(const char *str)
 		return 0;
 
 	str1 = _strdup(str);
-	strip(str1);
+	u_strstrip(str1, ' ');
 
 	ptr1 = str1;
 
@@ -3619,17 +3606,23 @@ int parse_offer_delay(const char *str)
 		memset(r, 0, sizeof(*r));
 
 		r->delay = strtol(ptr1, &endptr, 10);
-		if (*endptr)
+		if (*endptr) {
+			_free(r);
 			goto out_err;
+		}
 
 		if (list_empty(&conf_offer_delay))
 			r->conn_cnt = 0;
 		else {
-			if (!ptr3)
+			if (!ptr3) {
+				_free(r);
 				goto out_err;
+			}
 			r->conn_cnt = strtol(ptr3 + 1, &endptr, 10);
-			if (*endptr)
+			if (*endptr) {
+				_free(r);
 				goto out_err;
+			}
 		}
 
 		list_add_tail(&r->entry, &conf_offer_delay);
@@ -3644,6 +3637,11 @@ int parse_offer_delay(const char *str)
 	return 0;
 
 out_err:
+	while (!list_empty(&conf_offer_delay)) {
+		r = list_entry(conf_offer_delay.next, typeof(*r), entry);
+		list_del(&r->entry);
+		_free(r);
+	}
 	_free(str1);
 	log_error("ipoe: failed to parse offer-delay\n");
 	return -1;
diff --git a/accel-pppd/ctrl/pppoe/disc.c b/accel-pppd/ctrl/pppoe/disc.c
index e673a97a..f7f5c781 100644
--- a/accel-pppd/ctrl/pppoe/disc.c
+++ b/accel-pppd/ctrl/pppoe/disc.c
@@ -77,7 +77,7 @@ static struct disc_net *init_net(const struct ap_net *net)
 	fcntl(sock, F_SETFD, FD_CLOEXEC);
 	net->set_nonblocking(sock, 1);
 
-	n = _malloc(sizeof(*net) + (HASH_BITS + 1) * sizeof(struct tree));
+	n = _malloc(sizeof(*n) + (HASH_BITS + 1) * sizeof(struct tree));
 	tree = n->tree;
 
 	for (i = 0; i <= HASH_BITS; i++) {
@@ -110,7 +110,7 @@ static void free_net(struct disc_net *net)
 	pthread_mutex_lock(&nets_lock);
 	for (i = 0; i < MAX_NET; i++) {
 		if (nets[i] == net) {
-			memcpy(nets + i, nets + i + 1, net_cnt - i - 1);
+			memmove(nets + i, nets + i + 1, (net_cnt - i - 1) * sizeof(nets[0]));
 			net_cnt--;
 			break;
 		}
@@ -363,6 +363,7 @@ static int disc_read(struct triton_md_handler_t *h)
 		if (hdr->type != 1) {
 			if (conf_verbose)
 				log_warn("pppoe: discarding packet (unsupported type %i)\n", hdr->type);
+			continue;
 		}
 
 		if (forward(net, src.sll_ifindex, pack, n))
diff --git a/accel-pppd/ctrl/pppoe/dpado.c b/accel-pppd/ctrl/pppoe/dpado.c
index 351a43dc..dc570dda 100644
--- a/accel-pppd/ctrl/pppoe/dpado.c
+++ b/accel-pppd/ctrl/pppoe/dpado.c
@@ -11,6 +11,7 @@
 #include "triton.h"
 #include "log.h"
 #include "memdebug.h"
+#include "utils.h"
 
 #include "pppoe.h"
 
@@ -60,19 +61,6 @@ void dpado_check_prev(int conn_cnt)
 	pthread_mutex_unlock(&dpado_range_lock);
 }
 
-static void strip(char *str)
-{
-	char *ptr = str;
-	char *endptr = strchr(str, 0);
-	while (1) {
-		ptr = strchr(ptr, ' ');
-		if (ptr)
-			memmove(ptr, ptr + 1, endptr - ptr - 1);
-		else
-			break;
-	}
-}
-
 int dpado_parse(const char *str)
 {
 	char *str1 = _strdup(str);
@@ -81,7 +69,7 @@ int dpado_parse(const char *str)
 	LIST_HEAD(range_list);
 	struct dpado_range_t *r;
 
-	strip(str1);
+	u_strstrip(str1, ' ');
 
 	ptr1 = str1;
 
@@ -97,17 +85,23 @@ int dpado_parse(const char *str)
 		memset(r, 0, sizeof(*r));
 
 		r->pado_delay = strtol(ptr1, &endptr, 10);
-		if (*endptr)
+		if (*endptr) {
+			_free(r);
 			goto out_err;
+		}
 
 		if (list_empty(&range_list))
 			r->conn_cnt = INT_MAX;
 		else {
-			if (!ptr3)
+			if (!ptr3) {
+				_free(r);
 				goto out_err;
+			}
 			r->conn_cnt = strtol(ptr3 + 1, &endptr, 10);
-			if (*endptr)
+			if (*endptr) {
+				_free(r);
 				goto out_err;
+			}
 		}
 
 		list_add_tail(&r->entry, &range_list);
@@ -160,6 +154,11 @@ int dpado_parse(const char *str)
 	return 0;
 
 out_err:
+	while (!list_empty(&range_list)) {
+		r = list_entry(range_list.next, typeof(*r), entry);
+		list_del(&r->entry);
+		_free(r);
+	}
 	_free(str1);
 	log_emerg("pppoe: pado_delay: invalid format\n");
 	return -1;
diff --git a/accel-pppd/ctrl/pppoe/pppoe.c b/accel-pppd/ctrl/pppoe/pppoe.c
index 93824af5..d543a129 100644
--- a/accel-pppd/ctrl/pppoe/pppoe.c
+++ b/accel-pppd/ctrl/pppoe/pppoe.c
@@ -1234,6 +1234,12 @@ padr_tags_done:
 		return;
 	}
 
+	if (!service_name_tag) {
+		if (conf_verbose)
+			log_warn("pppoe: discard PADR packet (no Service-Name tag present)\n");
+		return;
+	}
+
 	if (ntohs(ac_cookie_tag->tag_len) != COOKIE_LENGTH) {
 		if (conf_verbose)
 			log_warn("pppoe: discard PADR packet (incorrect AC-Cookie tag length)\n");