From fd2cd2bce6328264ce9cb9bc371d7349319724a8 Mon Sep 17 00:00:00 2001 From: Vladislav Grishenko Date: Sun, 26 Jul 2026 13:19:07 +0500 Subject: sstp: express escape buffer bound as one invariant (size + PPP_FCSLEN) * 2 + 2 equals 8b781b94's size*2 + 2 + PPP_FCSLEN*2 but can't collapse back to the 1801847a under-allocating form. --- accel-pppd/ctrl/sstp/sstp.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) (limited to 'accel-pppd/ctrl') diff --git a/accel-pppd/ctrl/sstp/sstp.c b/accel-pppd/ctrl/sstp/sstp.c index 6c2b9ca9..1ab08a14 100644 --- a/accel-pppd/ctrl/sstp/sstp.c +++ b/accel-pppd/ctrl/sstp/sstp.c @@ -1846,7 +1846,8 @@ static int sstp_recv_data_packet(struct sstp_conn_t *conn, struct sstp_hdr *hdr) buf_put_data(buf, hdr->data, size); #else - buf = alloc_buf(size*2 + 2 + PPP_FCSLEN*2); + /* payload and FCS octets may both double when escaped, plus 2 flags */ + buf = alloc_buf((size + PPP_FCSLEN) * 2 + 2); if (!buf) { log_error("sstp: no memory\n"); return -1; -- cgit v1.2.3