diff options
author | Kozlov Dmitry <xeb@mail.ru> | 2011-10-06 21:28:48 +0400 |
---|---|---|
committer | Kozlov Dmitry <xeb@mail.ru> | 2011-10-06 21:28:48 +0400 |
commit | 2405fd6ba52618f07c0fa11d85c0f039653678bc (patch) | |
tree | 0cc55d1368d3be31df0cc1370854ee891f4b88c6 /accel-pppd/ppp/ppp_ipv6cp.c | |
parent | a8462baac3790dfa8f1c6b3cb715de0ec4fcbe74 (diff) | |
download | accel-ppp-xebd-2405fd6ba52618f07c0fa11d85c0f039653678bc.tar.gz accel-ppp-xebd-2405fd6ba52618f07c0fa11d85c0f039653678bc.zip |
ppp: options header sanity check
Diffstat (limited to 'accel-pppd/ppp/ppp_ipv6cp.c')
-rw-r--r-- | accel-pppd/ppp/ppp_ipv6cp.c | 16 |
1 files changed, 12 insertions, 4 deletions
diff --git a/accel-pppd/ppp/ppp_ipv6cp.c b/accel-pppd/ppp/ppp_ipv6cp.c index a984e43..5479f31 100644 --- a/accel-pppd/ppp/ppp_ipv6cp.c +++ b/accel-pppd/ppp/ppp_ipv6cp.c @@ -392,13 +392,12 @@ static int ipv6cp_recv_conf_req(struct ppp_ipv6cp_t *ipv6cp, uint8_t *data, int while (size > 0) { hdr = (struct ipv6cp_opt_hdr_t *)data; + if (!hdr->len || hdr->len > size) + break; + ropt = _malloc(sizeof(*ropt)); memset(ropt, 0, sizeof(*ropt)); - if (hdr->len > size) - ropt->len = size; - else - ropt->len = hdr->len; ropt->hdr = hdr; ropt->state = IPV6CP_OPT_NONE; list_add_tail(&ropt->entry, &ipv6cp->ropt_list); @@ -504,6 +503,9 @@ static int ipv6cp_recv_conf_rej(struct ppp_ipv6cp_t *ipv6cp, uint8_t *data, int while (size > 0) { hdr = (struct ipv6cp_opt_hdr_t *)data; + if (!hdr->len || hdr->len > size) + break; + list_for_each_entry(lopt, &ipv6cp->options, entry) { if (lopt->id == hdr->id) { if (!lopt->h->recv_conf_rej) @@ -542,6 +544,9 @@ static int ipv6cp_recv_conf_nak(struct ppp_ipv6cp_t *ipv6cp, uint8_t *data, int while (size > 0) { hdr = (struct ipv6cp_opt_hdr_t *)data; + if (!hdr->len || hdr->len > size) + break; + list_for_each_entry(lopt, &ipv6cp->options, entry) { if (lopt->id == hdr->id) { if (conf_ppp_verbose) { @@ -582,6 +587,9 @@ static int ipv6cp_recv_conf_ack(struct ppp_ipv6cp_t *ipv6cp, uint8_t *data, int while (size > 0) { hdr = (struct ipv6cp_opt_hdr_t *)data; + if (!hdr->len || hdr->len > size) + break; + list_for_each_entry(lopt, &ipv6cp->options, entry) { if (lopt->id == hdr->id) { if (conf_ppp_verbose) { |