46 lines
1.5 KiB
Diff
46 lines
1.5 KiB
Diff
From a75fb7b198eed50d769c80c36629f38346882cbf Mon Sep 17 00:00:00 2001
|
|
From: Paul Mackerras <paulus@ozlabs.org>
|
|
Date: Thu, 4 Aug 2022 12:23:08 +1000
|
|
Subject: [PATCH] pppdump: Avoid out-of-range access to packet buffer
|
|
|
|
This fixes a potential vulnerability where data is written to spkt.buf
|
|
and rpkt.buf without a check on the array index. To fix this, we
|
|
check the array index (pkt->cnt) before storing the byte or
|
|
incrementing the count. This also means we no longer have a potential
|
|
signed integer overflow on the increment of pkt->cnt.
|
|
|
|
Fortunately, pppdump is not used in the normal process of setting up a
|
|
PPP connection, is not installed setuid-root, and is not invoked
|
|
automatically in any scenario that I am aware of.
|
|
|
|
Signed-off-by: Paul Mackerras <paulus@ozlabs.org>
|
|
---
|
|
pppdump/pppdump.c | 7 ++++++-
|
|
1 file changed, 6 insertions(+), 1 deletion(-)
|
|
|
|
diff --git a/pppdump/pppdump.c b/pppdump/pppdump.c
|
|
index 2b815fc9..b85a8627 100644
|
|
--- a/pppdump/pppdump.c
|
|
+++ b/pppdump/pppdump.c
|
|
@@ -297,6 +297,10 @@ dumpppp(f)
|
|
printf("%s aborted packet:\n ", dir);
|
|
q = " ";
|
|
}
|
|
+ if (pkt->cnt >= sizeof(pkt->buf)) {
|
|
+ printf("%s over-long packet truncated:\n ", dir);
|
|
+ q = " ";
|
|
+ }
|
|
nb = pkt->cnt;
|
|
p = pkt->buf;
|
|
pkt->cnt = 0;
|
|
@@ -400,7 +404,8 @@ dumpppp(f)
|
|
c ^= 0x20;
|
|
pkt->esc = 0;
|
|
}
|
|
- pkt->buf[pkt->cnt++] = c;
|
|
+ if (pkt->cnt < sizeof(pkt->buf))
|
|
+ pkt->buf[pkt->cnt++] = c;
|
|
break;
|
|
}
|
|
}
|