From 7cf7432017bf5386e8b8907aa3abb9e6c45f12bb Mon Sep 17 00:00:00 2001 From: Denys Fedoryshchenko Date: Mon, 7 Sep 2026 22:08:04 +0300 Subject: ppp: add remaining discovery and buffer reuse safeguards Require exactly one PADR Service-Name, drop Echo-Requests exceeding the negotiated MTU, and clear pooled payloads before reuse. Retain upstream's silent malformed-PADR rejection and received-packet length checks. Adapted from Ritika Chopra's accel-ppp-ng PR #40, T8464/T8830. Co-authored-by: Ritika Chopra --- accel-pppd/ppp/ppp_lcp.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) (limited to 'accel-pppd/ppp') diff --git a/accel-pppd/ppp/ppp_lcp.c b/accel-pppd/ppp/ppp_lcp.c index 2424ca94..4af28dd0 100644 --- a/accel-pppd/ppp/ppp_lcp.c +++ b/accel-pppd/ppp/ppp_lcp.c @@ -634,7 +634,10 @@ static void lcp_recv_echo_repl(struct ppp_lcp_t *lcp, uint8_t *data, int size) static void send_echo_reply(struct ppp_lcp_t *lcp) { struct lcp_hdr_t *hdr = (struct lcp_hdr_t*)lcp->ppp->buf; - //uint32_t magic = *(uint32_t *)(hdr + 1); + uint16_t len = ntohs(hdr->len); + + if (len > lcp->ppp->mtu) + return; lcp->echo_sent = 0; lcp->last_echo_ts = _time(); @@ -646,7 +649,7 @@ static void send_echo_reply(struct ppp_lcp_t *lcp) if (conf_ppp_verbose) log_ppp_debug("send [LCP EchoRep id=%x ]\n", hdr->id, lcp->magic); - ppp_chan_send(lcp->ppp, hdr, min(ntohs(hdr->len), lcp->ppp->mtu) + 2); + ppp_chan_send(lcp->ppp, hdr, len + 2); } static void send_echo_request(struct triton_timer_t *t) -- cgit v1.2.3