From 3853053fc88c1b9a34b90174de25c5965a484e1b Mon Sep 17 00:00:00 2001 From: Guillaume Nault Date: Thu, 16 Jan 2014 21:24:54 +0100 Subject: pppoe: fix TR-101 tag length check The length field of PPPoE TR-101 sub-tags only takes the payload size into account (as opposed to its RADIUS counterpart that stores the full sub-tag length, including the 2 bytes long header). Signed-off-by: Guillaume Nault --- accel-pppd/ctrl/pppoe/tr101.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) (limited to 'accel-pppd/ctrl') diff --git a/accel-pppd/ctrl/pppoe/tr101.c b/accel-pppd/ctrl/pppoe/tr101.c index 5d1c39a..1d77f2e 100644 --- a/accel-pppd/ctrl/pppoe/tr101.c +++ b/accel-pppd/ctrl/pppoe/tr101.c @@ -58,25 +58,25 @@ static int tr101_send_request(struct pppoe_tag *tr101, struct rad_packet_t *pack return -1; break; case OPT_ACTUAL_DATA_RATE_UP: - if (len != 6) + if (len != 4) goto inval; if (rad_packet_add_int(pack, "ADSL-Forum", "Actual-Data-Rate-Upstream", ntohl(*(uint32_t *)ptr))) return -1; break; case OPT_ACTUAL_DATA_RATE_DOWN: - if (len != 6) + if (len != 4) goto inval; if (rad_packet_add_int(pack, "ADSL-Forum", "Actual-Data-Rate-Downstream", ntohl(*(uint32_t *)ptr))) return -1; break; case OPT_MIN_DATA_RATE_UP: - if (len != 6) + if (len != 4) goto inval; if (rad_packet_add_int(pack, "ADSL-Forum", "Minimum-Data-Rate-Upstream", ntohl(*(uint32_t *)ptr))) return -1; break; case OPT_MIN_DATA_RATE_DOWN: - if (len != 6) + if (len != 4) goto inval; if (rad_packet_add_int(pack, "ADSL-Forum", "Minimum-Data-Rate-Downstream", ntohl(*(uint32_t *)ptr))) return -1; -- cgit v1.2.3