From 2405fd6ba52618f07c0fa11d85c0f039653678bc Mon Sep 17 00:00:00 2001 From: Kozlov Dmitry Date: Thu, 6 Oct 2011 21:28:48 +0400 Subject: ppp: options header sanity check --- accel-pppd/ppp/ppp_lcp.c | 17 ++++++++++++----- 1 file changed, 12 insertions(+), 5 deletions(-) (limited to 'accel-pppd/ppp/ppp_lcp.c') diff --git a/accel-pppd/ppp/ppp_lcp.c b/accel-pppd/ppp/ppp_lcp.c index fa23436d..955b859d 100644 --- a/accel-pppd/ppp/ppp_lcp.c +++ b/accel-pppd/ppp/ppp_lcp.c @@ -368,14 +368,12 @@ static int lcp_recv_conf_req(struct ppp_lcp_t *lcp, uint8_t *data, int size) while (size > 0) { hdr = (struct lcp_opt_hdr_t *)data; + if (!hdr->len || hdr->len > size) + break; + ropt = _malloc(sizeof(*ropt)); memset(ropt, 0, sizeof(*ropt)); - if (hdr->len > size) - ropt->len = size; - else - ropt->len = hdr->len; - ropt->hdr = hdr; ropt->state = LCP_OPT_NONE; list_add_tail(&ropt->entry, &lcp->ropt_list); @@ -461,6 +459,9 @@ static int lcp_recv_conf_rej(struct ppp_lcp_t *lcp, uint8_t *data, int size) while (size > 0) { hdr = (struct lcp_opt_hdr_t *)data; + if (!hdr->len || hdr->len > size) + break; + list_for_each_entry(lopt, &lcp->options, entry) { if (lopt->id == hdr->id) { if (conf_ppp_verbose) { @@ -503,6 +504,9 @@ static int lcp_recv_conf_nak(struct ppp_lcp_t *lcp, uint8_t *data, int size) while (size > 0) { hdr = (struct lcp_opt_hdr_t *)data; + if (!hdr->len || hdr->len > size) + break; + list_for_each_entry(lopt,&lcp->options,entry) { if (lopt->id == hdr->id) { if (conf_ppp_verbose) { @@ -543,6 +547,9 @@ static int lcp_recv_conf_ack(struct ppp_lcp_t *lcp, uint8_t *data, int size) while (size > 0) { hdr = (struct lcp_opt_hdr_t *)data; + if (!hdr->len || hdr->len > size) + break; + list_for_each_entry(lopt, &lcp->options, entry) { if (lopt->id == hdr->id) { if (conf_ppp_verbose) { -- cgit v1.2.3