From e014cb2cb46f9a5778fbf8a819a1ad263a911c84 Mon Sep 17 00:00:00 2001 From: Denys Fedoryshchenko Date: Mon, 7 Sep 2026 22:08:04 +0300 Subject: radius: validate VRF names through Access-Accept and CoA Reject oversized and embedded-NUL VRF attributes and allocation failures. Keep explicit CoA lengths, restrict removal to literal 0, and bound the session API and shared interface lookup. Preserve default VRF removal. Adapted from Ritika Chopra's accel-ppp-ng PR #40, T8611, with the same validation boundary extended to the CoA path. Co-authored-by: Ritika Chopra --- accel-pppd/net.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) (limited to 'accel-pppd/net.c') diff --git a/accel-pppd/net.c b/accel-pppd/net.c index c619deed..b31cdf44 100644 --- a/accel-pppd/net.c +++ b/accel-pppd/net.c @@ -223,9 +223,15 @@ static int def_get_ifindex(const char *ifname) { struct kern_net *n = container_of(net, typeof(*n), net); struct ifreq ifr; + size_t len; + + if (!ifname || (len = strnlen(ifname, IFNAMSIZ)) >= IFNAMSIZ) { + log_ppp_error("invalid interface name\n"); + return -1; + } memset(&ifr, 0, sizeof(ifr)); - strcpy(ifr.ifr_name, ifname); + memcpy(ifr.ifr_name, ifname, len); if (ioctl(n->sock, SIOCGIFINDEX, &ifr)) { log_ppp_error("ioctl(SIOCGIFINDEX): %s\n", strerror(errno)); -- cgit v1.2.3