diff options
| author | John Baldwin <jhb@FreeBSD.org> | 2026-06-10 13:44:10 +0000 |
|---|---|---|
| committer | John Baldwin <jhb@FreeBSD.org> | 2026-06-10 13:44:10 +0000 |
| commit | 4d8fde8cff0796f32e659036543aa17d16a15b1b (patch) | |
| tree | c0942e105a104a9df3ae0b11460b2e48896d34af | |
| parent | 7e971892dfc5aac20bd62be7817941dbaed55f42 (diff) | |
ppp: Reject FSM messages whose length is smaller than the message header
PR: 271843
Reported by: Robert Morris <rtm@lcs.mit.edu>
Reviewed by: des, emaste
Differential Revision: https://reviews.freebsd.org/D57139
| -rw-r--r-- | usr.sbin/ppp/fsm.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/usr.sbin/ppp/fsm.c b/usr.sbin/ppp/fsm.c index 5c011bef7f4f..060a9149a6af 100644 --- a/usr.sbin/ppp/fsm.c +++ b/usr.sbin/ppp/fsm.c @@ -1060,6 +1060,12 @@ fsm_Input(struct fsm *fp, struct mbuf *bp) m_freem(bp); return; } + if (ntohs(lh.length) < sizeof(lh)) { + log_Printf(LogWARN, "%s: Header length %d is too small - dropped\n", + fp->link->name, (int)ntohs(lh.length)); + m_freem(bp); + return; + } if (lh.code < fp->min_code || lh.code > fp->max_code || lh.code > sizeof FsmCodes / sizeof *FsmCodes) { |