welterde/l2tpns
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

ppp: Also choke on options with invalid length 1

Browse source
This commit is contained in:
Samuel Thibault 2025-03-08 18:39:20 -05:00
parent 557a3944e6
commit ffcaf851ca
1 changed files with 3 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

6
ppp.c
View file

@ -631,7 +631,7 @@ void processlcp(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
int type = o[0];
int length = o[1];
if (length == 0 || type == 0 || x < length) break;
if (length == 0 || length == 1 || type == 0 || x < length) break;
switch (type)
{
case 1: // Maximum-Receive-Unit
@ -1314,7 +1314,7 @@ void processipcp(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
while (length > 2)
{
if (!o[1] || o[1] > length) return;
if (!o[1] || o[1] == 1 || o[1] > length) return;
switch (*o)
{
@ -1573,7 +1573,7 @@ void processipv6cp(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
while (length > 2)
{
if (!o[1] || o[1] > length) return;
if (!o[1] || o[1] == 1 || o[1] > length) return;
switch (*o)
{