imrcpan/freebsd
1
0 Fork 0
mirror of https://github.com/freebsd/freebsd-src.git synced 2026-10-28 11:25:21 +01:00
Code Issues Packages Projects Releases Wiki Activity

ppp: Avoid overflow when formatting endpoint discriminator options

Browse Source 
Each byte of the address is represented by a pair of characters, so we
should be multiplying len by 2 when figuring out how much buffer space
we have.  Previously, a sufficiently large option could cause an
overflow of the global "result" buffer.

Approved by:	re (cperciva)
Reported by:	Joshua Rogers <[email protected]>
Tested by:	Décio Brandão (0xDBJ)
MFC after:	3 days
Sponsored by:	The FreeBSD Foundation
Differential Revision:	https://reviews.freebsd.org/D58555

(cherry picked from commit e004ff15f8)
(cherry picked from commit 607c41d8f8)
This commit is contained in:
Mark Johnston authored and Colin Percival committed 2026-08-20 10:52:58 -07:00
1 parent 43bbea2cc8
commit 281fb7d8a2
1 file changed
+6 -6
Download Patch File Download Diff File Expand all files Collapse all files
usr.sbin/ppp/mp.c
+6 -6
View File
@@ -931,10 +931,10 @@ mp_Enddisc(u_char c, const char *address, size_t len)
case ENDDISC_MAGIC:
sprintf(result, "Magic: 0x");
header = strlen(result);
if (len + header + 1 > sizeof result)
len = sizeof result - header - 1;
if (2 * len + header + 1 > sizeof result)
len = (sizeof result - header - 1) / 2;
for (f = 0; f < len; f++)
sprintf(result + header + 2 * f, "%02x", address[f]);
sprintf(result + header + 2 * f, "%02x", (unsigned char)address[f]);
break;
case ENDDISC_PSN:
@@ -944,10 +944,10 @@ mp_Enddisc(u_char c, const char *address, size_t len)
default:
sprintf(result, "%d: ", (int)c);
header = strlen(result);
if (len + header + 1 > sizeof result)
len = sizeof result - header - 1;
if (2 * len + header + 1 > sizeof result)
len = (sizeof result - header - 1) / 2;
for (f = 0; f < len; f++)
sprintf(result + header + 2 * f, "%02x", address[f]);
sprintf(result + header + 2 * f, "%02x", (unsigned char)address[f]);
break;
}
return result;