diff options
author | cperciva <cperciva@FreeBSD.org> | 2006-08-23 22:06:08 +0000 |
---|---|---|
committer | cperciva <cperciva@FreeBSD.org> | 2006-08-23 22:06:08 +0000 |
commit | dba2c26a5edcc18aae7b7f3555eb4349e0ee73ba (patch) | |
tree | 5bda32e34b835400f754061e47ef561feabb5929 /sys/net/if_spppsubr.c | |
parent | bdd032b9cb2d7ae15c23174a3fd637db826031a7 (diff) | |
download | FreeBSD-src-dba2c26a5edcc18aae7b7f3555eb4349e0ee73ba.zip FreeBSD-src-dba2c26a5edcc18aae7b7f3555eb4349e0ee73ba.tar.gz |
Correct buffer overflow in the handling of LCP options in ppp(4)
Security: FreeBSD-SA-06:18.ppp
Diffstat (limited to 'sys/net/if_spppsubr.c')
-rw-r--r-- | sys/net/if_spppsubr.c | 36 |
1 files changed, 24 insertions, 12 deletions
diff --git a/sys/net/if_spppsubr.c b/sys/net/if_spppsubr.c index 7af0728..1b44370 100644 --- a/sys/net/if_spppsubr.c +++ b/sys/net/if_spppsubr.c @@ -2363,7 +2363,8 @@ sppp_lcp_RCR(struct sppp *sp, struct lcp_header *h, int len) /* pass 1: check for things that need to be rejected */ p = (void*) (h+1); - for (rlen=0; len>1 && p[1]; len-=p[1], p+=p[1]) { + for (rlen=0; len >= 2 && p[1] >= 2 && len >= p[1]; + len-=p[1], p+=p[1]) { if (debug) log(-1, " %s ", sppp_lcp_opt_name(*p)); switch (*p) { @@ -2442,7 +2443,8 @@ sppp_lcp_RCR(struct sppp *sp, struct lcp_header *h, int len) p = (void*) (h+1); len = origlen; - for (rlen=0; len>1 && p[1]; len-=p[1], p+=p[1]) { + for (rlen=0; len >= 2 && p[1] >= 2 && len >= p[1]; + len-=p[1], p+=p[1]) { if (debug) log(-1, " %s ", sppp_lcp_opt_name(*p)); switch (*p) { @@ -2584,7 +2586,8 @@ sppp_lcp_RCN_rej(struct sppp *sp, struct lcp_header *h, int len) SPP_ARGS(ifp)); p = (void*) (h+1); - for (; len > 1 && p[1]; len -= p[1], p += p[1]) { + for (; len >= 2 && p[1] >= 2 && len >= p[1]; + len -= p[1], p += p[1]) { if (debug) log(-1, " %s ", sppp_lcp_opt_name(*p)); switch (*p) { @@ -2648,7 +2651,8 @@ sppp_lcp_RCN_nak(struct sppp *sp, struct lcp_header *h, int len) SPP_ARGS(ifp)); p = (void*) (h+1); - for (; len > 1 && p[1]; len -= p[1], p += p[1]) { + for (; len >= 2 && p[1] >= 2 && len >= p[1]; + len -= p[1], p += p[1]) { if (debug) log(-1, " %s ", sppp_lcp_opt_name(*p)); switch (*p) { @@ -3039,7 +3043,8 @@ sppp_ipcp_RCR(struct sppp *sp, struct lcp_header *h, int len) log(LOG_DEBUG, SPP_FMT "ipcp parse opts: ", SPP_ARGS(ifp)); p = (void*) (h+1); - for (rlen=0; len>1 && p[1]; len-=p[1], p+=p[1]) { + for (rlen=0; len >= 2 && p[1] >= 2 && len >= p[1]; + len-=p[1], p+=p[1]) { if (debug) log(-1, " %s ", sppp_ipcp_opt_name(*p)); switch (*p) { @@ -3108,7 +3113,8 @@ sppp_ipcp_RCR(struct sppp *sp, struct lcp_header *h, int len) SPP_ARGS(ifp)); p = (void*) (h+1); len = origlen; - for (rlen=0; len>1 && p[1]; len-=p[1], p+=p[1]) { + for (rlen=0; len >= 2 && p[1] >= 2 && len >= p[1]; + len-=p[1], p+=p[1]) { if (debug) log(-1, " %s ", sppp_ipcp_opt_name(*p)); switch (*p) { @@ -3239,7 +3245,8 @@ sppp_ipcp_RCN_rej(struct sppp *sp, struct lcp_header *h, int len) SPP_ARGS(ifp)); p = (void*) (h+1); - for (; len > 1 && p[1]; len -= p[1], p += p[1]) { + for (; len >= 2 && p[1] >= 2 && len >= p[1]; + len -= p[1], p += p[1]) { if (debug) log(-1, " %s ", sppp_ipcp_opt_name(*p)); switch (*p) { @@ -3285,7 +3292,8 @@ sppp_ipcp_RCN_nak(struct sppp *sp, struct lcp_header *h, int len) SPP_ARGS(ifp)); p = (void*) (h+1); - for (; len > 1 && p[1]; len -= p[1], p += p[1]) { + for (; len >= 2 && p[1] >= 2 && len >= p[1]; + len -= p[1], p += p[1]) { if (debug) log(-1, " %s ", sppp_ipcp_opt_name(*p)); switch (*p) { @@ -3511,7 +3519,8 @@ sppp_ipv6cp_RCR(struct sppp *sp, struct lcp_header *h, int len) SPP_ARGS(ifp)); p = (void*) (h+1); ifidcount = 0; - for (rlen=0; len>1 && p[1]; len-=p[1], p+=p[1]) { + for (rlen=0; len >= 2 && p[1] >= 2 && len >= p[1]; + len-=p[1], p+=p[1]) { if (debug) log(-1, " %s", sppp_ipv6cp_opt_name(*p)); switch (*p) { @@ -3561,7 +3570,8 @@ sppp_ipv6cp_RCR(struct sppp *sp, struct lcp_header *h, int len) p = (void*) (h+1); len = origlen; type = CONF_ACK; - for (rlen=0; len>1 && p[1]; len-=p[1], p+=p[1]) { + for (rlen=0; len >= 2 && p[1] >= 2 && len >= p[1]; + len-=p[1], p+=p[1]) { if (debug) log(-1, " %s", sppp_ipv6cp_opt_name(*p)); switch (*p) { @@ -3660,7 +3670,8 @@ sppp_ipv6cp_RCN_rej(struct sppp *sp, struct lcp_header *h, int len) SPP_ARGS(ifp)); p = (void*) (h+1); - for (; len > 1 && p[1]; len -= p[1], p += p[1]) { + for (; len >= 2 && p[1] >= 2 && len >= p[1]; + len -= p[1], p += p[1]) { if (debug) log(-1, " %s", sppp_ipv6cp_opt_name(*p)); switch (*p) { @@ -3706,7 +3717,8 @@ sppp_ipv6cp_RCN_nak(struct sppp *sp, struct lcp_header *h, int len) SPP_ARGS(ifp)); p = (void*) (h+1); - for (; len > 1 && p[1]; len -= p[1], p += p[1]) { + for (; len >= 2 && p[1] >= 2 && len >= p[1]; + len -= p[1], p += p[1]) { if (debug) log(-1, " %s", sppp_ipv6cp_opt_name(*p)); switch (*p) { |