diff options
| author | Denys Fedoryshchenko <denys.f@collabora.com> | 2025-11-30 13:47:21 +0200 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2025-11-30 13:47:21 +0200 |
| commit | 63165ee7fd9abec04fb5f497d11ab09e21e10b9b (patch) | |
| tree | 973b76801a86bd640dc34ca41aee628731f8dd88 | |
| parent | ac31c84a36c069c90e37ab28a9e980c0749b2b37 (diff) | |
| parent | 2bbf451b94a3a9a96cdc8cbdb60a559f275dc0e6 (diff) | |
| download | accel-ppp-63165ee7fd9abec04fb5f497d11ab09e21e10b9b.tar.gz accel-ppp-63165ee7fd9abec04fb5f497d11ab09e21e10b9b.zip | |
Merge pull request #269 from nuclearcat/fix-buffer-overflow
l2tp: fix buffer overflow and type errors in Calling/Called Number handling
| -rw-r--r-- | accel-pppd/ctrl/l2tp/l2tp.c | 8 |
1 files changed, 4 insertions, 4 deletions
diff --git a/accel-pppd/ctrl/l2tp/l2tp.c b/accel-pppd/ctrl/l2tp/l2tp.c index 19cd9077..ecf66f91 100644 --- a/accel-pppd/ctrl/l2tp/l2tp.c +++ b/accel-pppd/ctrl/l2tp/l2tp.c @@ -3335,8 +3335,8 @@ static int l2tp_recv_ICRQ(struct l2tp_conn_t *conn, uint16_t sid = 0; uint16_t res = 0; uint16_t err = 0; - uint8_t *calling[254] = {0}; - uint8_t *called[254] = {0}; + uint8_t calling[L2TP_AVP_LEN_MASK] = {0}; + uint8_t called[L2TP_AVP_LEN_MASK] = {0}; int n = 0; int m = 0; @@ -3426,7 +3426,7 @@ static int l2tp_recv_ICRQ(struct l2tp_conn_t *conn, sid = sess->sid; /* Allocate memory for Calling-Number if exists, and put it to l2tp_sess_t structure */ - if (calling != NULL && n > 0) { + if (n > 0) { sess->calling_num = _malloc(n+1); if (sess->calling_num == NULL) { log_tunnel(log_warn, conn, "can't allocate memory for Calling Number attribute. Will use LAC IP instead\n"); @@ -3438,7 +3438,7 @@ static int l2tp_recv_ICRQ(struct l2tp_conn_t *conn, } /* Allocate memory for Called-Number if exists, and put it to l2tp_sess_t structure */ - if (called != NULL && m > 1) { + if (m > 1) { sess->called_num = _malloc(m+1); if (sess->called_num == NULL) { log_tunnel(log_warn, conn, "can't allocate memory for Called Number attribute. Will use my IP instead\n"); |