From 676a6f6eccf98df6ccd3feb31ddd4313a8659811 Mon Sep 17 00:00:00 2001 From: Kozlov Dmitry Date: Mon, 10 Oct 2011 10:12:38 +0400 Subject: Revert "ppp: options header sanity check" This reverts commit 2405fd6ba52618f07c0fa11d85c0f039653678bc. --- accel-pppd/ppp/ppp_ccp.c | 17 +++++------------ accel-pppd/ppp/ppp_ipcp.c | 20 +++++--------------- accel-pppd/ppp/ppp_ipv6cp.c | 16 ++++------------ accel-pppd/ppp/ppp_lcp.c | 17 +++++------------ 4 files changed, 19 insertions(+), 51 deletions(-) diff --git a/accel-pppd/ppp/ppp_ccp.c b/accel-pppd/ppp/ppp_ccp.c index 6b97215..88adc30 100644 --- a/accel-pppd/ppp/ppp_ccp.c +++ b/accel-pppd/ppp/ppp_ccp.c @@ -387,12 +387,14 @@ static int ccp_recv_conf_req(struct ppp_ccp_t *ccp, uint8_t *data, int size) while (size > 0) { hdr = (struct ccp_opt_hdr_t *)data; - if (!hdr->len || hdr->len > size) - break; - ropt = _malloc(sizeof(*ropt)); memset(ropt, 0, sizeof(*ropt)); + if (hdr->len > size) + ropt->len = size; + else + ropt->len = hdr->len; + ropt->hdr = hdr; ropt->state = CCP_OPT_NONE; list_add_tail(&ropt->entry, &ccp->ropt_list); @@ -481,9 +483,6 @@ static int ccp_recv_conf_rej(struct ppp_ccp_t *ccp, uint8_t *data, int size) while (size > 0) { hdr = (struct ccp_opt_hdr_t *)data; - if (!hdr->len || hdr->len > size) - break; - list_for_each_entry(lopt, &ccp->options, entry) { if (lopt->id == hdr->id) { if (!lopt->h->recv_conf_rej) @@ -522,9 +521,6 @@ static int ccp_recv_conf_nak(struct ppp_ccp_t *ccp, uint8_t *data, int size) while (size > 0) { hdr = (struct ccp_opt_hdr_t *)data; - if (!hdr->len || hdr->len > size) - break; - list_for_each_entry(lopt, &ccp->options, entry) { if (lopt->id == hdr->id) { if (conf_ppp_verbose) { @@ -565,9 +561,6 @@ static int ccp_recv_conf_ack(struct ppp_ccp_t *ccp, uint8_t *data, int size) while (size > 0) { hdr = (struct ccp_opt_hdr_t *)data; - if (!hdr->len || hdr->len > size) - break; - list_for_each_entry(lopt, &ccp->options, entry) { if (lopt->id == hdr->id) { if (conf_ppp_verbose) { diff --git a/accel-pppd/ppp/ppp_ipcp.c b/accel-pppd/ppp/ppp_ipcp.c index 63818e8..aee0317 100644 --- a/accel-pppd/ppp/ppp_ipcp.c +++ b/accel-pppd/ppp/ppp_ipcp.c @@ -392,14 +392,13 @@ static int ipcp_recv_conf_req(struct ppp_ipcp_t *ipcp, uint8_t *data, int size) while (size > 0) { hdr = (struct ipcp_opt_hdr_t *)data; - if (!hdr->len || hdr->len > size) - break; - ropt = _malloc(sizeof(*ropt)); memset(ropt, 0, sizeof(*ropt)); - ropt->len = hdr->len; - + if (hdr->len > size) + ropt->len = size; + else + ropt->len = hdr->len; ropt->hdr = hdr; ropt->state = IPCP_OPT_NONE; list_add_tail(&ropt->entry, &ipcp->ropt_list); @@ -504,10 +503,7 @@ static int ipcp_recv_conf_rej(struct ppp_ipcp_t *ipcp, uint8_t *data, int size) while (size > 0) { hdr = (struct ipcp_opt_hdr_t *)data; - - if (!hdr->len || hdr->len > size) - break; - + list_for_each_entry(lopt, &ipcp->options, entry) { if (lopt->id == hdr->id) { if (!lopt->h->recv_conf_rej) @@ -546,9 +542,6 @@ static int ipcp_recv_conf_nak(struct ppp_ipcp_t *ipcp, uint8_t *data, int size) while (size > 0) { hdr = (struct ipcp_opt_hdr_t *)data; - if (!hdr->len || hdr->len > size) - break; - list_for_each_entry(lopt, &ipcp->options, entry) { if (lopt->id == hdr->id) { if (conf_ppp_verbose) { @@ -589,9 +582,6 @@ static int ipcp_recv_conf_ack(struct ppp_ipcp_t *ipcp, uint8_t *data, int size) while (size > 0) { hdr = (struct ipcp_opt_hdr_t *)data; - if (!hdr->len || hdr->len > size) - break; - list_for_each_entry(lopt, &ipcp->options, entry) { if (lopt->id == hdr->id) { if (conf_ppp_verbose) { diff --git a/accel-pppd/ppp/ppp_ipv6cp.c b/accel-pppd/ppp/ppp_ipv6cp.c index 5479f31..a984e43 100644 --- a/accel-pppd/ppp/ppp_ipv6cp.c +++ b/accel-pppd/ppp/ppp_ipv6cp.c @@ -392,12 +392,13 @@ static int ipv6cp_recv_conf_req(struct ppp_ipv6cp_t *ipv6cp, uint8_t *data, int while (size > 0) { hdr = (struct ipv6cp_opt_hdr_t *)data; - if (!hdr->len || hdr->len > size) - break; - ropt = _malloc(sizeof(*ropt)); memset(ropt, 0, sizeof(*ropt)); + if (hdr->len > size) + ropt->len = size; + else + ropt->len = hdr->len; ropt->hdr = hdr; ropt->state = IPV6CP_OPT_NONE; list_add_tail(&ropt->entry, &ipv6cp->ropt_list); @@ -503,9 +504,6 @@ static int ipv6cp_recv_conf_rej(struct ppp_ipv6cp_t *ipv6cp, uint8_t *data, int while (size > 0) { hdr = (struct ipv6cp_opt_hdr_t *)data; - if (!hdr->len || hdr->len > size) - break; - list_for_each_entry(lopt, &ipv6cp->options, entry) { if (lopt->id == hdr->id) { if (!lopt->h->recv_conf_rej) @@ -544,9 +542,6 @@ static int ipv6cp_recv_conf_nak(struct ppp_ipv6cp_t *ipv6cp, uint8_t *data, int while (size > 0) { hdr = (struct ipv6cp_opt_hdr_t *)data; - if (!hdr->len || hdr->len > size) - break; - list_for_each_entry(lopt, &ipv6cp->options, entry) { if (lopt->id == hdr->id) { if (conf_ppp_verbose) { @@ -587,9 +582,6 @@ static int ipv6cp_recv_conf_ack(struct ppp_ipv6cp_t *ipv6cp, uint8_t *data, int while (size > 0) { hdr = (struct ipv6cp_opt_hdr_t *)data; - if (!hdr->len || hdr->len > size) - break; - list_for_each_entry(lopt, &ipv6cp->options, entry) { if (lopt->id == hdr->id) { if (conf_ppp_verbose) { diff --git a/accel-pppd/ppp/ppp_lcp.c b/accel-pppd/ppp/ppp_lcp.c index 955b859..fa23436 100644 --- a/accel-pppd/ppp/ppp_lcp.c +++ b/accel-pppd/ppp/ppp_lcp.c @@ -368,12 +368,14 @@ static int lcp_recv_conf_req(struct ppp_lcp_t *lcp, uint8_t *data, int size) while (size > 0) { hdr = (struct lcp_opt_hdr_t *)data; - if (!hdr->len || hdr->len > size) - break; - ropt = _malloc(sizeof(*ropt)); memset(ropt, 0, sizeof(*ropt)); + if (hdr->len > size) + ropt->len = size; + else + ropt->len = hdr->len; + ropt->hdr = hdr; ropt->state = LCP_OPT_NONE; list_add_tail(&ropt->entry, &lcp->ropt_list); @@ -459,9 +461,6 @@ static int lcp_recv_conf_rej(struct ppp_lcp_t *lcp, uint8_t *data, int size) while (size > 0) { hdr = (struct lcp_opt_hdr_t *)data; - if (!hdr->len || hdr->len > size) - break; - list_for_each_entry(lopt, &lcp->options, entry) { if (lopt->id == hdr->id) { if (conf_ppp_verbose) { @@ -504,9 +503,6 @@ static int lcp_recv_conf_nak(struct ppp_lcp_t *lcp, uint8_t *data, int size) while (size > 0) { hdr = (struct lcp_opt_hdr_t *)data; - if (!hdr->len || hdr->len > size) - break; - list_for_each_entry(lopt,&lcp->options,entry) { if (lopt->id == hdr->id) { if (conf_ppp_verbose) { @@ -547,9 +543,6 @@ static int lcp_recv_conf_ack(struct ppp_lcp_t *lcp, uint8_t *data, int size) while (size > 0) { hdr = (struct lcp_opt_hdr_t *)data; - if (!hdr->len || hdr->len > size) - break; - list_for_each_entry(lopt, &lcp->options, entry) { if (lopt->id == hdr->id) { if (conf_ppp_verbose) { -- cgit v1.2.3