diff options
| author | Mark Johnston <markj@FreeBSD.org> | 2026-08-03 15:18:25 +0000 |
|---|---|---|
| committer | Mark Johnston <markj@FreeBSD.org> | 2026-08-03 15:22:13 +0000 |
| commit | e004ff15f87e6aa8f2aa13cd5600ae13457b95f1 (patch) | |
| tree | f051e0e7b2b5093251b6aac278eb05f08ad08766 | |
| parent | fb63bc67483ee52245d6161150702974da3d001c (diff) | |
ppp: Avoid overflow when formatting endpoint discriminator options
Each byte of the address is represented by a pair of characters, so we
should be multiplying len by 2 when figuring out how much buffer space
we have. Previously, a sufficiently large option could cause an
overflow of the global "result" buffer.
Reported by: Joshua Rogers <joshua@joshua.hu>
Tested by: Décio Brandão (0xDBJ)
MFC after: 3 days
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D58555
| -rw-r--r-- | usr.sbin/ppp/mp.c | 12 |
1 files changed, 6 insertions, 6 deletions
diff --git a/usr.sbin/ppp/mp.c b/usr.sbin/ppp/mp.c index 84ddb6e053e3..f5f9dd9ddece 100644 --- a/usr.sbin/ppp/mp.c +++ b/usr.sbin/ppp/mp.c @@ -931,10 +931,10 @@ mp_Enddisc(u_char c, const char *address, size_t len) case ENDDISC_MAGIC: sprintf(result, "Magic: 0x"); header = strlen(result); - if (len + header + 1 > sizeof result) - len = sizeof result - header - 1; + if (2 * len + header + 1 > sizeof result) + len = (sizeof result - header - 1) / 2; for (f = 0; f < len; f++) - sprintf(result + header + 2 * f, "%02x", address[f]); + sprintf(result + header + 2 * f, "%02x", (unsigned char)address[f]); break; case ENDDISC_PSN: @@ -944,10 +944,10 @@ mp_Enddisc(u_char c, const char *address, size_t len) default: sprintf(result, "%d: ", (int)c); header = strlen(result); - if (len + header + 1 > sizeof result) - len = sizeof result - header - 1; + if (2 * len + header + 1 > sizeof result) + len = (sizeof result - header - 1) / 2; for (f = 0; f < len; f++) - sprintf(result + header + 2 * f, "%02x", address[f]); + sprintf(result + header + 2 * f, "%02x", (unsigned char)address[f]); break; } return result; |