Date: Fri, 31 Jul 2026 13:29:27 +0000 From: Mark Johnston <markj@FreeBSD.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org Subject: git: b9d07a430822 - main - ppp: Reject invalid endpoint discriminator options Message-ID: <6a6ca337.19d4d.cff5114@gitrepo.freebsd.org>
index | next in thread | raw e-mail
The branch main has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=b9d07a4308226b683b64827e0aaed1180e0da996 commit b9d07a4308226b683b64827e0aaed1180e0da996 Author: Mark Johnston <markj@FreeBSD.org> AuthorDate: 2026-07-31 13:13:26 +0000 Commit: Mark Johnston <markj@FreeBSD.org> CommitDate: 2026-07-31 13:13:26 +0000 ppp: Reject invalid endpoint discriminator options Per RFC1717 section 5.1.3, the option length must be at least three. Processing an undersized option would trigger a large out-of-bounds write. PR: 271910 Reported by: Robert Morris Reported by: Décio Brandão (0xDBJ) Reviewed by: emaste MFC after: 1 week Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D58554 --- usr.sbin/ppp/lcp.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/usr.sbin/ppp/lcp.c b/usr.sbin/ppp/lcp.c index 462f3c4281bb..7029610a1591 100644 --- a/usr.sbin/ppp/lcp.c +++ b/usr.sbin/ppp/lcp.c @@ -1195,6 +1195,12 @@ LcpDecodeConfig(struct fsm *fp, u_char *cp, u_char *end, int mode_type, break; case TY_ENDDISC: + if (opt->hdr.len < 3) { + log_Printf(LogLCP, "%s - too short\n", request); + fsm_rej(dec, opt); + lcp->my_reject |= (1 << opt->hdr.id); + break; + } mp = &lcp->fsm.bundle->ncp.mp; log_Printf(LogLCP, "%s %s\n", request, mp_Enddisc(opt->data[0], opt->data + 1, opt->hdr.len - 3));home | help
Want to link to this message? Use this
URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?6a6ca337.19d4d.cff5114>