From bb931e76a6d4d3d933e94827a22ca0cb36f5fac5 Mon Sep 17 00:00:00 2001 From: Denys Fedoryshchenko Date: Fri, 6 Feb 2026 18:04:29 +0200 Subject: radius: MS-CHAP2-Success unchecked memcpy(40 bytes) Also fix small typo. Signed-off-by: Denys Fedoryshchenko --- accel-pppd/radius/auth.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/accel-pppd/radius/auth.c b/accel-pppd/radius/auth.c index 69f1b2ef..73e7a50c 100644 --- a/accel-pppd/radius/auth.c +++ b/accel-pppd/radius/auth.c @@ -434,7 +434,10 @@ static int rad_auth_mschap_v2_recv(struct rad_req_t *req) if (req->reply->code == CODE_ACCESS_ACCEPT) { ra = rad_packet_find_attr(req->reply, "Microsoft", "MS-CHAP2-Success"); if (!ra) { - log_error("radius:auth:mschap-v2: 'MS-CHAP-Success' not found in radius response\n"); + log_error("radius:auth:mschap-v2: 'MS-CHAP2-Success' not found in radius response\n"); + return -1; + } else if (ra->len < 43) { + log_error("radius:auth:mschap-v2: 'MS-CHAP2-Success' too short (%i)\n", ra->len); return -1; } else memcpy(rpd->auth_ctx->authenticator, ra->val.octets + 3, 40); -- cgit v1.2.3