From 1de8f3bea7317551413e5dec1a9daa420436c769 Mon Sep 17 00:00:00 2001 From: Guillaume Nault Date: Thu, 16 Jan 2014 21:23:58 +0100 Subject: pppoe: check for tag format validity in PADR messages Avoid parsing inconsistent PPPoE tags when handling PADR. Signed-off-by: Guillaume Nault --- accel-pppd/ctrl/pppoe/pppoe.c | 11 +++++++++++ 1 file changed, 11 insertions(+) (limited to 'accel-pppd/ctrl') diff --git a/accel-pppd/ctrl/pppoe/pppoe.c b/accel-pppd/ctrl/pppoe/pppoe.c index 9d30c62..22ddf43 100644 --- a/accel-pppd/ctrl/pppoe/pppoe.c +++ b/accel-pppd/ctrl/pppoe/pppoe.c @@ -927,6 +927,17 @@ static void pppoe_recv_PADR(struct pppoe_serv_t *serv, uint8_t *pack, int size) for (n = 0; n < ntohs(hdr->length); n += sizeof(*tag) + ntohs(tag->tag_len)) { tag = (struct pppoe_tag *)(pack + ETH_HLEN + sizeof(*hdr) + n); + + if (n + sizeof(*tag) > ntohs(hdr->length)) { + if (conf_verbose) + log_warn("pppoe: discard PADR packet (truncated tag)\n"); + return; + } + if (n + sizeof(*tag) + ntohs(tag->tag_len) > ntohs(hdr->length)) { + if (conf_verbose) + log_warn("pppoe: discard PADR packet (invalid tag length)\n"); + return; + } switch (ntohs(tag->tag_type)) { case TAG_END_OF_LIST: break; -- cgit v1.2.3