welterde/l2tpns
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

ppp: Also choke on options with invalid length 1

Browse source
This commit is contained in:
Samuel Thibault 2025-03-08 18:39:20 -05:00
parent 557a3944e6
commit ffcaf851ca
1 changed files with 3 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

6
ppp.c
View file

@ -631,7 +631,7 @@ void processlcp(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
int type = o[0]; int type = o[0];
int length = o[1]; int length = o[1];
if (length == 0 || type == 0 || x < length) break; if (length == 0 || length == 1 || type == 0 || x < length) break;
switch (type) switch (type)
{ {
case 1: // Maximum-Receive-Unit case 1: // Maximum-Receive-Unit
@ -1314,7 +1314,7 @@ void processipcp(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
while (length > 2) while (length > 2)
{ {
if (!o[1] || o[1] > length) return; if (!o[1] || o[1] == 1 || o[1] > length) return;
switch (*o) switch (*o)
{ {
@ -1573,7 +1573,7 @@ void processipv6cp(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
while (length > 2) while (length > 2)
{ {
if (!o[1] || o[1] > length) return; if (!o[1] || o[1] == 1 || o[1] > length) return;
switch (*o) switch (*o)
{ {