diff options
| author | Mark Johnston <markj@FreeBSD.org> | 2026-07-31 13:13:26 +0000 |
|---|---|---|
| committer | Mark Johnston <markj@FreeBSD.org> | 2026-07-31 13:13:26 +0000 |
| commit | b9d07a4308226b683b64827e0aaed1180e0da996 (patch) | |
| tree | b35931d968e1c64b3229b6e15c3d7e18c5df1be0 | |
| parent | b566e0a7232b4989e79df95c2f02bdedef3ac4e7 (diff) | |
ppp: Reject invalid endpoint discriminator options
Per RFC1717 section 5.1.3, the option length must be at least three.
Processing an undersized option would trigger a large out-of-bounds
write.
PR: 271910
Reported by: Robert Morris
Reported by: Décio Brandão (0xDBJ)
Reviewed by: emaste
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D58554
| -rw-r--r-- | usr.sbin/ppp/lcp.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/usr.sbin/ppp/lcp.c b/usr.sbin/ppp/lcp.c index 462f3c4281bb..7029610a1591 100644 --- a/usr.sbin/ppp/lcp.c +++ b/usr.sbin/ppp/lcp.c @@ -1195,6 +1195,12 @@ LcpDecodeConfig(struct fsm *fp, u_char *cp, u_char *end, int mode_type, break; case TY_ENDDISC: + if (opt->hdr.len < 3) { + log_Printf(LogLCP, "%s - too short\n", request); + fsm_rej(dec, opt); + lcp->my_reject |= (1 << opt->hdr.id); + break; + } mp = &lcp->fsm.bundle->ncp.mp; log_Printf(LogLCP, "%s %s\n", request, mp_Enddisc(opt->data[0], opt->data + 1, opt->hdr.len - 3)); |