From: Paul Mackerras <paulus@samba.org>
Date: Fri, 14 Aug 2015 17:56:26 +1000
Subject: [PATCH] pppd: ipxcp: Prevent buffer overrun on remote router name

This fixes an if condition to prevent a possible 1-byte overrun
on ipxcp_hisoptions[0].name.

Reported-by: "Sabas Rosales, Blanca E" <blanca.e.sabas.rosales@intel.com>
Signed-off-by: Paul Mackerras <paulus@ozlabs.org>

Imported from ppp_2.4.7-2+4.1.debian.tar.xz

Signed-off-by: Michael Olbrich <m.olbrich@pengutronix.de>
---
 pppd/ipxcp.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pppd/ipxcp.c b/pppd/ipxcp.c
index 7b2343e15537..aaff10f76200 100644
--- a/pppd/ipxcp.c
+++ b/pppd/ipxcp.c
@@ -1194,7 +1194,7 @@ ipxcp_reqci(f, inp, len, reject_if_disagree)
 	case IPX_ROUTER_NAME:
 	    if (cilen >= CILEN_NAME) {
 		int name_size = cilen - CILEN_NAME;
-		if (name_size > sizeof (ho->name))
+		if (name_size >= sizeof (ho->name))
 		    name_size = sizeof (ho->name) - 1;
 		memset (ho->name, 0, sizeof (ho->name));
 		memcpy (ho->name, p, name_size);