From 96ff385e6b9084b4c6ba58292e396e18ff7d04d5 Mon Sep 17 00:00:00 2001 From: Denys Fedoryshchenko Date: Fri, 6 Feb 2026 18:02:00 +0200 Subject: radius: Vendor attribute parsing over-reads When parsing vendor-specific attributes (type 26), the code reads internal structure without checking that the attribute data is long enough. Signed-off-by: Denys Fedoryshchenko --- accel-pppd/radius/packet.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/accel-pppd/radius/packet.c b/accel-pppd/radius/packet.c index aae2c6a1..339eac74 100644 --- a/accel-pppd/radius/packet.c +++ b/accel-pppd/radius/packet.c @@ -224,9 +224,17 @@ int rad_packet_recv(int fd, struct rad_packet_t **p, struct sockaddr_in *addr) goto out_err; } if (id == 26) { + if (len < 4) { + log_ppp_warn("radius:packet: vendor attribute too short (%i)\n", len); + goto out_err; + } vendor_id = ntohl(*(uint32_t *)ptr); vendor = rad_dict_find_vendor_id(vendor_id); if (vendor) { + if (len < 4 + vendor->tag + vendor->len) { + log_ppp_warn("radius:packet: vendor %i attribute too short (%i)\n", vendor_id, len); + goto out_err; + } ptr += 4; if (vendor->tag == 2) -- cgit v1.2.3 From e3c3c7752944af85ed2854eaaf7482b018cae8b4 Mon Sep 17 00:00:00 2001 From: Denys Fedoryshchenko Date: Fri, 6 Feb 2026 18:04:29 +0200 Subject: radius: MS-CHAP2-Success unchecked memcpy(40 bytes) Also fix small typo. Signed-off-by: Denys Fedoryshchenko --- accel-pppd/radius/auth.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/accel-pppd/radius/auth.c b/accel-pppd/radius/auth.c index 69f1b2ef..73e7a50c 100644 --- a/accel-pppd/radius/auth.c +++ b/accel-pppd/radius/auth.c @@ -434,7 +434,10 @@ static int rad_auth_mschap_v2_recv(struct rad_req_t *req) if (req->reply->code == CODE_ACCESS_ACCEPT) { ra = rad_packet_find_attr(req->reply, "Microsoft", "MS-CHAP2-Success"); if (!ra) { - log_error("radius:auth:mschap-v2: 'MS-CHAP-Success' not found in radius response\n"); + log_error("radius:auth:mschap-v2: 'MS-CHAP2-Success' not found in radius response\n"); + return -1; + } else if (ra->len < 43) { + log_error("radius:auth:mschap-v2: 'MS-CHAP2-Success' too short (%i)\n", ra->len); return -1; } else memcpy(rpd->auth_ctx->authenticator, ra->val.octets + 3, 40); -- cgit v1.2.3 From 3c3cf8d2bcc94d054e32e9b8db637a15d6b80f62 Mon Sep 17 00:00:00 2001 From: Denys Fedoryshchenko Date: Fri, 6 Feb 2026 18:05:35 +0200 Subject: radius: Fix invalid check after mempool allocation This check left old, relevant to mmap, migrate to proper check. Signed-off-by: Denys Fedoryshchenko --- accel-pppd/radius/packet.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/accel-pppd/radius/packet.c b/accel-pppd/radius/packet.c index 339eac74..bf01bbdc 100644 --- a/accel-pppd/radius/packet.c +++ b/accel-pppd/radius/packet.c @@ -167,9 +167,8 @@ int rad_packet_recv(int fd, struct rad_packet_t **p, struct sockaddr_in *addr) if (!pack) return 0; - //ptr = mmap(NULL, REQ_LENGTH_MAX, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANON, -1, 0); ptr = mempool_alloc(buf_pool); - if (ptr == MAP_FAILED) { + if (!ptr) { log_emerg("radius:packet: out of memory\n"); goto out_err; } -- cgit v1.2.3 From ee53459c7d09d7bcb2482ebead9a1d10f5ad7180 Mon Sep 17 00:00:00 2001 From: Denys Fedoryshchenko Date: Fri, 6 Feb 2026 18:07:20 +0200 Subject: radius: Fix to same type of allocator and deallocator Signed-off-by: Denys Fedoryshchenko --- accel-pppd/radius/req.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/accel-pppd/radius/req.c b/accel-pppd/radius/req.c index e3c41996..4c982d88 100644 --- a/accel-pppd/radius/req.c +++ b/accel-pppd/radius/req.c @@ -78,9 +78,9 @@ static struct rad_req_t *__rad_req_alloc(struct radius_pd_t *rpd, int code, cons if (code == CODE_ACCESS_REQUEST && conf_blast_protection) { uint8_t buf[HMAC_MD5_LEN] = {0}; req->pack->message_authenticator = 1; - req->pack->secret = (uint8_t *)strdup(req->serv->secret); + req->pack->secret = (uint8_t *)_strdup(req->serv->secret); if (rad_packet_add_octets(req->pack, NULL, "Message-Authenticator", buf, HMAC_MD5_LEN)) { - free(req->pack->secret); + _free(req->pack->secret); req->pack->secret = NULL; goto out_err; } -- cgit v1.2.3 From e09b9c81d54c326c3eca2267d38d91db0ca93f8a Mon Sep 17 00:00:00 2001 From: Denys Fedoryshchenko Date: Fri, 6 Feb 2026 18:09:44 +0200 Subject: radius: Invalid integer and date parsing Actually 3 fixes in same place: INTEGER: size mismatch now breaks instead of falling through - a malformed INTEGER attribute is rejected rather than silently parsed with a wrong size INTEGER/DATE split: each case has its own break, no more fallthrough DATE: strictly requires len == 4 (per RFC 2865), warns and skips otherwise instead of silently accepting 1 or 2-byte dates Signed-off-by: Denys Fedoryshchenko --- accel-pppd/radius/packet.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/accel-pppd/radius/packet.c b/accel-pppd/radius/packet.c index bf01bbdc..cfc0bc29 100644 --- a/accel-pppd/radius/packet.c +++ b/accel-pppd/radius/packet.c @@ -292,9 +292,10 @@ int rad_packet_recv(int fd, struct rad_packet_t **p, struct sockaddr_in *addr) attr->val.octets = ptr; break; case ATTR_TYPE_INTEGER: - if (len != da->size) + if (len != da->size) { log_ppp_warn("radius:packet: attribute %s has invalid length %i (must be %i)\n", da->name, len, da->size); - case ATTR_TYPE_DATE: + break; + } if (len == 4) attr->val.integer = ntohl(*(uint32_t*)ptr); else if (len == 2) @@ -302,6 +303,12 @@ int rad_packet_recv(int fd, struct rad_packet_t **p, struct sockaddr_in *addr) else if (len == 1) attr->val.integer = *ptr; break; + case ATTR_TYPE_DATE: + if (len == 4) + attr->val.integer = ntohl(*(uint32_t*)ptr); + else + log_ppp_warn("radius:packet: attribute %s has invalid length %i (must be 4)\n", da->name, len); + break; case ATTR_TYPE_IPADDR: case ATTR_TYPE_IFID: case ATTR_TYPE_IPV6ADDR: -- cgit v1.2.3