diff options
| author | Kozlov Dmitry <xeb@mail.ru> | 2013-07-26 10:46:55 +0400 |
|---|---|---|
| committer | Kozlov Dmitry <xeb@mail.ru> | 2013-07-26 10:46:55 +0400 |
| commit | 56b69f5f1a585b32bb2fd0a89c9310ba98d7e86d (patch) | |
| tree | 8394ceed00a32fe12c9a6cbfa90f38c455454e7a /accel-pppd/auth | |
| parent | 8f8b893405d2e2b792885c4875eb8bdc77ce9d2f (diff) | |
| parent | 37e2a417a6cb6a981c85dfdcd3245a48f99a4165 (diff) | |
| download | accel-ppp-xebd-56b69f5f1a585b32bb2fd0a89c9310ba98d7e86d.tar.gz accel-ppp-xebd-56b69f5f1a585b32bb2fd0a89c9310ba98d7e86d.zip | |
Merge branch 'master' of ssh://git.code.sf.net/p/accel-ppp/code
Diffstat (limited to 'accel-pppd/auth')
| -rw-r--r-- | accel-pppd/auth/auth_chap_md5.c | 2 | ||||
| -rw-r--r-- | accel-pppd/auth/auth_mschap_v1.c | 2 | ||||
| -rw-r--r-- | accel-pppd/auth/auth_mschap_v2.c | 2 |
3 files changed, 3 insertions, 3 deletions
diff --git a/accel-pppd/auth/auth_chap_md5.c b/accel-pppd/auth/auth_chap_md5.c index 7e14b8d..8aa3018 100644 --- a/accel-pppd/auth/auth_chap_md5.c +++ b/accel-pppd/auth/auth_chap_md5.c @@ -404,7 +404,7 @@ static void chap_recv(struct ppp_handler_t *h) struct chap_auth_data_t *d = container_of(h, typeof(*d), h); struct chap_hdr_t *hdr = (struct chap_hdr_t *)d->ppp->buf; - if (d->ppp->buf_size < sizeof(*hdr) || ntohs(hdr->len) < HDR_LEN || ntohs(hdr->len) < d->ppp->buf_size - 2) { + if (d->ppp->buf_size < sizeof(*hdr) || ntohs(hdr->len) < HDR_LEN || ntohs(hdr->len) > d->ppp->buf_size - 2) { log_ppp_warn("chap-md5: short packet received\n"); return; } diff --git a/accel-pppd/auth/auth_mschap_v1.c b/accel-pppd/auth/auth_mschap_v1.c index adfbc60..0dcaffd 100644 --- a/accel-pppd/auth/auth_mschap_v1.c +++ b/accel-pppd/auth/auth_mschap_v1.c @@ -470,7 +470,7 @@ static void chap_recv(struct ppp_handler_t *h) struct chap_auth_data_t *d = container_of(h, typeof(*d), h); struct chap_hdr_t *hdr = (struct chap_hdr_t *)d->ppp->buf; - if (d->ppp->buf_size < sizeof(*hdr) || ntohs(hdr->len) < HDR_LEN || ntohs(hdr->len) < d->ppp->buf_size - 2) { + if (d->ppp->buf_size < sizeof(*hdr) || ntohs(hdr->len) < HDR_LEN || ntohs(hdr->len) > d->ppp->buf_size - 2) { log_ppp_warn("mschap-v1: short packet received\n"); return; } diff --git a/accel-pppd/auth/auth_mschap_v2.c b/accel-pppd/auth/auth_mschap_v2.c index 444a9df..3ee2adc 100644 --- a/accel-pppd/auth/auth_mschap_v2.c +++ b/accel-pppd/auth/auth_mschap_v2.c @@ -607,7 +607,7 @@ static void chap_recv(struct ppp_handler_t *h) struct chap_auth_data_t *d = container_of(h, typeof(*d), h); struct chap_hdr_t *hdr = (struct chap_hdr_t *)d->ppp->buf; - if (d->ppp->buf_size < sizeof(*hdr) || ntohs(hdr->len) < HDR_LEN || ntohs(hdr->len) < d->ppp->buf_size - 2) { + if (d->ppp->buf_size < sizeof(*hdr) || ntohs(hdr->len) < HDR_LEN || ntohs(hdr->len) > d->ppp->buf_size - 2) { log_ppp_warn("mschap-v2: short packet received\n"); return; } |