welterde/l2tpns
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

avoid endless loop in processipcp, processipv6cp

Browse source
This commit is contained in:
bodea 2006-02-17 14:35:53 +00:00
parent 995bae51b1
commit 8ba3da90ad
2 changed files with 10 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

1
Changes
View file

@ -4,6 +4,7 @@
- Handle LCP NAK of magic-number.
- Ensure session changes from LCP ConfigReq/ConfigNak are sent to cluster.
- Verify that RADIUS packets come from a configured server (Jonathan Yarden).
- Avoid endless loop in processipcp, processipv6cp.
* Mon Dec 19 2005 Brendan O'Dea <bod@optus.net> 2.1.15
- Drop backtrace.

14
ppp.c
View file

@ -1,6 +1,6 @@
// L2TPNS PPP Stuff
char const *cvs_id_ppp = "$Id: ppp.c,v 1.94 2006/01/19 21:31:25 bodea Exp $";
char const *cvs_id_ppp = "$Id: ppp.c,v 1.95 2006/02/17 14:35:54 bodea Exp $";
#include <stdio.h>
#include <string.h>
@ -1014,11 +1014,13 @@ void processipcp(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
while (length > 2)
{
if (!o[1] || o[1] > length) return;
switch (*o)
{
case 3: // ip address
gotip++; // seen address
if (o[1] != 6 || o[1] > length) return;
if (o[1] != 6) return;
addr = htonl(session[s].ip);
if (memcmp(o + 2, &addr, (sizeof addr)))
@ -1035,7 +1037,7 @@ void processipcp(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
break;
case 129: // primary DNS
if (o[1] != 6 || o[1] > length) return;
if (o[1] != 6) return;
addr = htonl(session[s].dns1);
if (memcmp(o + 2, &addr, (sizeof addr)))
@ -1047,7 +1049,7 @@ void processipcp(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
break;
case 131: // secondary DNS
if (o[1] != 6 || o[1] > length) return;
if (o[1] != 6) return;
addr = htonl(session[s].dns2);
if (memcmp(o + 2, &addr, sizeof(addr)))
@ -1239,11 +1241,13 @@ void processipv6cp(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
while (length > 2)
{
if (!o[1] || o[1] > length) return;
switch (*o)
{
case 1: // interface identifier
gotip++; // seen address
if (o[1] != 10 || o[1] > length) return;
if (o[1] != 10) return;
*(uint32_t *) ident = htonl(session[s].ip);
*(uint32_t *) (ident + 4) = 0;