blob: 7d98127c286fabeff105c8f9b9052396036ab125 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
|
From: Paul Mackerras <paulus@samba.org>
Date: Fri, 14 Aug 2015 17:56:26 +1000
Subject: [PATCH] pppd: ipxcp: Prevent buffer overrun on remote router name
This fixes an if condition to prevent a possible 1-byte overrun
on ipxcp_hisoptions[0].name.
Reported-by: "Sabas Rosales, Blanca E" <blanca.e.sabas.rosales@intel.com>
Signed-off-by: Paul Mackerras <paulus@ozlabs.org>
Imported from ppp_2.4.7-2+4.1.debian.tar.xz
Signed-off-by: Michael Olbrich <m.olbrich@pengutronix.de>
---
pppd/ipxcp.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/pppd/ipxcp.c b/pppd/ipxcp.c
index 7b2343e15537..aaff10f76200 100644
--- a/pppd/ipxcp.c
+++ b/pppd/ipxcp.c
@@ -1194,7 +1194,7 @@ ipxcp_reqci(f, inp, len, reject_if_disagree)
case IPX_ROUTER_NAME:
if (cilen >= CILEN_NAME) {
int name_size = cilen - CILEN_NAME;
- if (name_size > sizeof (ho->name))
+ if (name_size >= sizeof (ho->name))
name_size = sizeof (ho->name) - 1;
memset (ho->name, 0, sizeof (ho->name));
memcpy (ho->name, p, name_size);
|
