diff options
| author | Dmitry Kozlov <xeb@mail.ru> | 2011-01-05 15:56:41 +0300 |
|---|---|---|
| committer | Dmitry Kozlov <xeb@mail.ru> | 2011-01-05 15:56:41 +0300 |
| commit | c675662132b07f30a43291bf001ac2f730b7b46e (patch) | |
| tree | ce26e10d83424670c55793f0f0b004161ef69d34 /accel-pppd | |
| parent | f28cb1b0a926f1ea98700b7871537ad1793511fd (diff) | |
| download | accel-ppp-c675662132b07f30a43291bf001ac2f730b7b46e.tar.gz accel-ppp-c675662132b07f30a43291bf001ac2f730b7b46e.zip | |
pppoe: tr101 fixes
Diffstat (limited to 'accel-pppd')
| -rw-r--r-- | accel-pppd/ctrl/pppoe/pppoe.c | 2 | ||||
| -rw-r--r-- | accel-pppd/ctrl/pppoe/tr101.c | 12 |
2 files changed, 8 insertions, 6 deletions
diff --git a/accel-pppd/ctrl/pppoe/pppoe.c b/accel-pppd/ctrl/pppoe/pppoe.c index 7860c4e..d718bed 100644 --- a/accel-pppd/ctrl/pppoe/pppoe.c +++ b/accel-pppd/ctrl/pppoe/pppoe.c @@ -125,6 +125,8 @@ static void disconnect(struct pppoe_conn_t *conn) _free(conn->host_uniq); if (conn->relay_sid) _free(conn->relay_sid); + if (conn->tr101) + _free(conn->tr101); triton_context_unregister(&conn->ctx); diff --git a/accel-pppd/ctrl/pppoe/tr101.c b/accel-pppd/ctrl/pppoe/tr101.c index cfb0fbc..2b48e51 100644 --- a/accel-pppd/ctrl/pppoe/tr101.c +++ b/accel-pppd/ctrl/pppoe/tr101.c @@ -30,24 +30,24 @@ static int tr101_send_request(struct pppoe_tag *tr101, struct rad_packet_t *pack goto inval; id = *ptr++; len = *ptr++; - if (ptr + len - 2 > endptr) + if (ptr + len > endptr) goto inval; if (type && id > 0x80) continue; switch (id) { case OPT_CIRCUIT_ID: - if (len - 2 > 63) + if (len > 63) goto inval; memcpy(str, ptr, len); - str[len - 2] = 0; + str[len] = 0; if (rad_packet_add_str(pack, "ADSL-Forum", "ADSL-Agent-Circuit-Id", str)) return -1; break; case OPT_REMOTE_AGENT_ID: - if (len - 2 > 63) + if (len > 63) goto inval; memcpy(str, ptr, len); - str[len - 2] = 0; + str[len] = 0; if (rad_packet_add_str(pack, "ADSL-Forum", "ADSL-Agent-Remote-Id", str)) return -1; break; @@ -76,7 +76,7 @@ static int tr101_send_request(struct pppoe_tag *tr101, struct rad_packet_t *pack return -1; break; } - ptr += len - 2; + ptr += len; } return 0; |