diff options
| author | Mark Johnston <markj@FreeBSD.org> | 2026-08-24 14:46:28 +0000 |
|---|---|---|
| committer | Mark Johnston <markj@FreeBSD.org> | 2026-08-24 21:51:29 +0000 |
| commit | 5c00c1e0227693109a24692f39806782afce6860 (patch) | |
| tree | 870c3a61888aa3e17a907b7640a7c1c5a5bf4ee8 | |
| parent | 428f4b194cef6ae2c73ff4c0c467f36f6b1a48c1 (diff) | |
ppp: Fix a buffer overflow in the endpoint discriminator set command
Approved by: so
Security: FreeBSD-SA-26:60.ppp
Security: CVE-2026-58097
Reported by: Reo Shiseki
MFC after: 3 days
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D59054
(cherry picked from commit 6cb7e368daab6f166b7c8e26367ea6fee4cdd03a)
(cherry picked from commit 55ee29bf351533644d35e82da87fd1661d879f04)
| -rw-r--r-- | usr.sbin/ppp/mp.c | 11 |
1 files changed, 8 insertions, 3 deletions
diff --git a/usr.sbin/ppp/mp.c b/usr.sbin/ppp/mp.c index f5f9dd9ddece..d4055f33056f 100644 --- a/usr.sbin/ppp/mp.c +++ b/usr.sbin/ppp/mp.c @@ -1020,9 +1020,14 @@ mp_SetEnddisc(struct cmdargs const *arg) mp->cfg.enddisc.len = 20; } else if (!strcasecmp(arg->argv[arg->argn], "psn")) { if (arg->argc > arg->argn+1) { - mp->cfg.enddisc.class = ENDDISC_PSN; - strcpy(mp->cfg.enddisc.address, arg->argv[arg->argn+1]); - mp->cfg.enddisc.len = strlen(mp->cfg.enddisc.address); + if (strlcpy(mp->cfg.enddisc.address, arg->argv[arg->argn+1], + sizeof(mp->cfg.enddisc.address)) >= sizeof(mp->cfg.enddisc.address)) { + log_Printf(LogWARN, "PSN endpoint too long\n"); + return 7; + } else { + mp->cfg.enddisc.class = ENDDISC_PSN; + mp->cfg.enddisc.len = strlen(mp->cfg.enddisc.address); + } } else { log_Printf(LogWARN, "PSN endpoint requires additional data\n"); return 5; |