From c5c87c41e79085e2c24999804e9076435e03f4f9 Mon Sep 17 00:00:00 2001 From: Kozlov Dmitry Date: Mon, 29 Nov 2010 10:51:21 +0300 Subject: l2tp: fixed bug of incorrect handling wrong length packets --- accel-pptpd/ctrl/l2tp/packet.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) (limited to 'accel-pptpd/ctrl/l2tp') diff --git a/accel-pptpd/ctrl/l2tp/packet.c b/accel-pptpd/ctrl/l2tp/packet.c index 40e6759..8646133 100644 --- a/accel-pptpd/ctrl/l2tp/packet.c +++ b/accel-pptpd/ctrl/l2tp/packet.c @@ -127,13 +127,13 @@ int l2tp_recv(int fd, struct l2tp_packet_t **p) if (n < sizeof(*hdr)) { if (conf_verbose) log_warn("l2tp: short packet received (%i/%i)\n", n, sizeof(*hdr)); - goto out_err; + goto out_err_hdr; } if (n < ntohs(hdr->length)) { if (conf_verbose) log_warn("l2tp: short packet received (%i/%i)\n", n, ntohs(hdr->length)); - goto out_err; + goto out_err_hdr; } if (hdr->T == 0) @@ -166,8 +166,7 @@ int l2tp_recv(int fd, struct l2tp_packet_t **p) pack = mempool_alloc(pack_pool); if (!pack) { log_emerg("l2tp: out of memory\n"); - mempool_free(buf); - return -1; + goto out_err_hdr; } memset(pack, 0, sizeof(*pack)); -- cgit v1.2.3