From 2ad648c3cdde7c5b439abde9566c6dedce966c9e Mon Sep 17 00:00:00 2001 From: Denys Fedoryshchenko Date: Sun, 9 Aug 2026 07:15:01 +0300 Subject: pptp: reject control messages shorter than the header PPTP_CTRL_SIZE() evaluates to 0 for unrecognised control types, so a message declaring length 0 with such a type passed the length check, reached process_packet() and was logged as unknown, after which in_size -= 0 consumed nothing. The stale header stayed at the head of the buffer and every later byte queued behind it, so the connection could never make progress: it stalled until in_size reached PPTP_CTRL_SIZE_MAX, at which point read() was called with a zero-length buffer, returned 0 and was misreported as "disconnect by peer". Require the declared length to cover the header, alongside the existing upper bound. --- accel-pppd/ctrl/pptp/pptp.c | 4 ++++ 1 file changed, 4 insertions(+) (limited to 'accel-pppd/ctrl') diff --git a/accel-pppd/ctrl/pptp/pptp.c b/accel-pppd/ctrl/pptp/pptp.c index 232c9fb5..b323dba6 100644 --- a/accel-pppd/ctrl/pptp/pptp.c +++ b/accel-pppd/ctrl/pptp/pptp.c @@ -567,6 +567,10 @@ static int pptp_read(struct triton_md_handler_t *h) log_ppp_error("pptp: invalid magic\n"); goto drop; } + if (ntohs(hdr->length) < sizeof(*hdr)) { + log_ppp_error("pptp: message is too short\n"); + goto drop; + } if (ntohs(hdr->length) >= PPTP_CTRL_SIZE_MAX) { log_ppp_error("pptp: message is too long\n"); goto drop; -- cgit v1.2.3