ppp: backport security fixes
[openwrt/staging/mkresin.git] / package / network / services / ppp / patches / 701-pppd-Fix-bounds-check-in-EAP-code.patch
1 From 8d7970b8f3db727fe798b65f3377fe6787575426 Mon Sep 17 00:00:00 2001
2 From: Paul Mackerras <paulus@ozlabs.org>
3 Date: Mon, 3 Feb 2020 15:53:28 +1100
4 Subject: [PATCH] pppd: Fix bounds check in EAP code
5
6 Given that we have just checked vallen < len, it can never be the case
7 that vallen >= len + sizeof(rhostname). This fixes the check so we
8 actually avoid overflowing the rhostname array.
9
10 Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
11 Signed-off-by: Paul Mackerras <paulus@ozlabs.org>
12 ---
13 pppd/eap.c | 4 ++--
14 1 file changed, 2 insertions(+), 2 deletions(-)
15
16 diff --git a/pppd/eap.c b/pppd/eap.c
17 index 94407f56a336..1b93db01aebd 100644
18 --- a/pppd/eap.c
19 +++ b/pppd/eap.c
20 @@ -1420,7 +1420,7 @@ int len;
21 }
22
23 /* Not so likely to happen. */
24 - if (vallen >= len + sizeof (rhostname)) {
25 + if (len - vallen >= sizeof (rhostname)) {
26 dbglog("EAP: trimming really long peer name down");
27 BCOPY(inp + vallen, rhostname, sizeof (rhostname) - 1);
28 rhostname[sizeof (rhostname) - 1] = '\0';
29 @@ -1846,7 +1846,7 @@ int len;
30 }
31
32 /* Not so likely to happen. */
33 - if (vallen >= len + sizeof (rhostname)) {
34 + if (len - vallen >= sizeof (rhostname)) {
35 dbglog("EAP: trimming really long peer name down");
36 BCOPY(inp + vallen, rhostname, sizeof (rhostname) - 1);
37 rhostname[sizeof (rhostname) - 1] = '\0';