1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
|
Index: sys/net/if_spppsubr.c
===================================================================
RCS file: /home/ncvs/src/sys/net/if_spppsubr.c,v
retrieving revision 1.124
diff -u -I__FBSDID -r1.124 if_spppsubr.c
--- sys/net/if_spppsubr.c 15 Jul 2006 02:49:35 -0000 1.124
+++ sys/net/if_spppsubr.c 21 Aug 2006 11:32:49 -0000
@@ -2363,7 +2363,8 @@
/* pass 1: check for things that need to be rejected */
p = (void*) (h+1);
- for (rlen=0; len>1 && p[1]; len-=p[1], p+=p[1]) {
+ for (rlen=0; len >= 2 && p[1] >= 2 && len >= p[1];
+ len-=p[1], p+=p[1]) {
if (debug)
log(-1, " %s ", sppp_lcp_opt_name(*p));
switch (*p) {
@@ -2442,7 +2443,8 @@
p = (void*) (h+1);
len = origlen;
- for (rlen=0; len>1 && p[1]; len-=p[1], p+=p[1]) {
+ for (rlen=0; len >= 2 && p[1] >= 2 && len >= p[1];
+ len-=p[1], p+=p[1]) {
if (debug)
log(-1, " %s ", sppp_lcp_opt_name(*p));
switch (*p) {
@@ -2584,7 +2586,8 @@
SPP_ARGS(ifp));
p = (void*) (h+1);
- for (; len > 1 && p[1]; len -= p[1], p += p[1]) {
+ for (; len >= 2 && p[1] >= 2 && len >= p[1];
+ len -= p[1], p += p[1]) {
if (debug)
log(-1, " %s ", sppp_lcp_opt_name(*p));
switch (*p) {
@@ -2648,7 +2651,8 @@
SPP_ARGS(ifp));
p = (void*) (h+1);
- for (; len > 1 && p[1]; len -= p[1], p += p[1]) {
+ for (; len >= 2 && p[1] >= 2 && len >= p[1];
+ len -= p[1], p += p[1]) {
if (debug)
log(-1, " %s ", sppp_lcp_opt_name(*p));
switch (*p) {
@@ -3039,7 +3043,8 @@
log(LOG_DEBUG, SPP_FMT "ipcp parse opts: ",
SPP_ARGS(ifp));
p = (void*) (h+1);
- for (rlen=0; len>1 && p[1]; len-=p[1], p+=p[1]) {
+ for (rlen=0; len >= 2 && p[1] >= 2 && len >= p[1];
+ len-=p[1], p+=p[1]) {
if (debug)
log(-1, " %s ", sppp_ipcp_opt_name(*p));
switch (*p) {
@@ -3108,7 +3113,8 @@
SPP_ARGS(ifp));
p = (void*) (h+1);
len = origlen;
- for (rlen=0; len>1 && p[1]; len-=p[1], p+=p[1]) {
+ for (rlen=0; len >= 2 && p[1] >= 2 && len >= p[1];
+ len-=p[1], p+=p[1]) {
if (debug)
log(-1, " %s ", sppp_ipcp_opt_name(*p));
switch (*p) {
@@ -3239,7 +3245,8 @@
SPP_ARGS(ifp));
p = (void*) (h+1);
- for (; len > 1 && p[1]; len -= p[1], p += p[1]) {
+ for (; len >= 2 && p[1] >= 2 && len >= p[1];
+ len -= p[1], p += p[1]) {
if (debug)
log(-1, " %s ", sppp_ipcp_opt_name(*p));
switch (*p) {
@@ -3285,7 +3292,8 @@
SPP_ARGS(ifp));
p = (void*) (h+1);
- for (; len > 1 && p[1]; len -= p[1], p += p[1]) {
+ for (; len >= 2 && p[1] >= 2 && len >= p[1];
+ len -= p[1], p += p[1]) {
if (debug)
log(-1, " %s ", sppp_ipcp_opt_name(*p));
switch (*p) {
@@ -3511,7 +3519,8 @@
SPP_ARGS(ifp));
p = (void*) (h+1);
ifidcount = 0;
- for (rlen=0; len>1 && p[1]; len-=p[1], p+=p[1]) {
+ for (rlen=0; len >= 2 && p[1] >= 2 && len >= p[1];
+ len-=p[1], p+=p[1]) {
if (debug)
log(-1, " %s", sppp_ipv6cp_opt_name(*p));
switch (*p) {
@@ -3561,7 +3570,8 @@
p = (void*) (h+1);
len = origlen;
type = CONF_ACK;
- for (rlen=0; len>1 && p[1]; len-=p[1], p+=p[1]) {
+ for (rlen=0; len >= 2 && p[1] >= 2 && len >= p[1];
+ len-=p[1], p+=p[1]) {
if (debug)
log(-1, " %s", sppp_ipv6cp_opt_name(*p));
switch (*p) {
@@ -3660,7 +3670,8 @@
SPP_ARGS(ifp));
p = (void*) (h+1);
- for (; len > 1 && p[1]; len -= p[1], p += p[1]) {
+ for (; len >= 2 && p[1] >= 2 && len >= p[1];
+ len -= p[1], p += p[1]) {
if (debug)
log(-1, " %s", sppp_ipv6cp_opt_name(*p));
switch (*p) {
@@ -3706,7 +3717,8 @@
SPP_ARGS(ifp));
p = (void*) (h+1);
- for (; len > 1 && p[1]; len -= p[1], p += p[1]) {
+ for (; len >= 2 && p[1] >= 2 && len >= p[1];
+ len -= p[1], p += p[1]) {
if (debug)
log(-1, " %s", sppp_ipv6cp_opt_name(*p));
switch (*p) {
|
