aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorColin Percival <cperciva@FreeBSD.org>2006-08-23 22:06:40 +0000
committerColin Percival <cperciva@FreeBSD.org>2006-08-23 22:06:40 +0000
commit82738e4f1527a6591bc297cf5d2450b6fe896ff4 (patch)
tree2b8caa05b0446657d8f54abcb012d0f0ecc324f3
parent5f4c5dadb2a5460ceffc8dc4b5c06335f3d910fc (diff)
downloadsrc-82738e4f1527a6591bc297cf5d2450b6fe896ff4.tar.gz
src-82738e4f1527a6591bc297cf5d2450b6fe896ff4.zip
Correct buffer overflow in the handling of LCP options in ppp(4)
Security: FreeBSD-SA-06:18.ppp Approved by: so (cperciva)
Notes
Notes: svn path=/releng/5.5/; revision=161557
-rw-r--r--UPDATING3
-rw-r--r--sys/conf/newvers.sh2
-rw-r--r--sys/net/if_spppsubr.c36
3 files changed, 28 insertions, 13 deletions
diff --git a/UPDATING b/UPDATING
index 1b0dd2e6b40b..af0abeb0f734 100644
--- a/UPDATING
+++ b/UPDATING
@@ -8,6 +8,9 @@ Items affecting the ports and packages system can be found in
/usr/ports/UPDATING. Please read that file before running
portupgrade.
+20060823: p3 FreeBSD-SA-06:18.ppp
+ Correct buffer overflow in the handling of LCP options in ppp(4).
+
20060614: p2 FreeBSD-SA-06:17.sendmail
Correct a bug in the handling of multipart messages by sendmail(8)
which can allow a malformed message to crash a sendmail queue
diff --git a/sys/conf/newvers.sh b/sys/conf/newvers.sh
index 127bb9030a54..a75b43da3d12 100644
--- a/sys/conf/newvers.sh
+++ b/sys/conf/newvers.sh
@@ -32,7 +32,7 @@
TYPE="FreeBSD"
REVISION="5.5"
-BRANCH="RELEASE-p2"
+BRANCH="RELEASE-p3"
RELEASE="${REVISION}-${BRANCH}"
VERSION="${TYPE} ${RELEASE}"
diff --git a/sys/net/if_spppsubr.c b/sys/net/if_spppsubr.c
index d7cf48441ee4..1a1ef624f580 100644
--- a/sys/net/if_spppsubr.c
+++ b/sys/net/if_spppsubr.c
@@ -2330,7 +2330,8 @@ sppp_lcp_RCR(struct sppp *sp, struct lcp_header *h, int len)
/* pass 1: check for things that need to be rejected */
p = (void*) (h+1);
- for (rlen=0; len>1 && p[1]; len-=p[1], p+=p[1]) {
+ for (rlen=0; len >= 2 && p[1] >= 2 && len >= p[1];
+ len-=p[1], p+=p[1]) {
if (debug)
log(-1, " %s ", sppp_lcp_opt_name(*p));
switch (*p) {
@@ -2409,7 +2410,8 @@ sppp_lcp_RCR(struct sppp *sp, struct lcp_header *h, int len)
p = (void*) (h+1);
len = origlen;
- for (rlen=0; len>1 && p[1]; len-=p[1], p+=p[1]) {
+ for (rlen=0; len >= 2 && p[1] >= 2 && len >= p[1];
+ len-=p[1], p+=p[1]) {
if (debug)
log(-1, " %s ", sppp_lcp_opt_name(*p));
switch (*p) {
@@ -2551,7 +2553,8 @@ sppp_lcp_RCN_rej(struct sppp *sp, struct lcp_header *h, int len)
SPP_ARGS(ifp));
p = (void*) (h+1);
- for (; len > 1 && p[1]; len -= p[1], p += p[1]) {
+ for (; len >= 2 && p[1] >= 2 && len >= p[1];
+ len -= p[1], p += p[1]) {
if (debug)
log(-1, " %s ", sppp_lcp_opt_name(*p));
switch (*p) {
@@ -2615,7 +2618,8 @@ sppp_lcp_RCN_nak(struct sppp *sp, struct lcp_header *h, int len)
SPP_ARGS(ifp));
p = (void*) (h+1);
- for (; len > 1 && p[1]; len -= p[1], p += p[1]) {
+ for (; len >= 2 && p[1] >= 2 && len >= p[1];
+ len -= p[1], p += p[1]) {
if (debug)
log(-1, " %s ", sppp_lcp_opt_name(*p));
switch (*p) {
@@ -3006,7 +3010,8 @@ sppp_ipcp_RCR(struct sppp *sp, struct lcp_header *h, int len)
log(LOG_DEBUG, SPP_FMT "ipcp parse opts: ",
SPP_ARGS(ifp));
p = (void*) (h+1);
- for (rlen=0; len>1 && p[1]; len-=p[1], p+=p[1]) {
+ for (rlen=0; len >= 2 && p[1] >= 2 && len >= p[1];
+ len-=p[1], p+=p[1]) {
if (debug)
log(-1, " %s ", sppp_ipcp_opt_name(*p));
switch (*p) {
@@ -3075,7 +3080,8 @@ sppp_ipcp_RCR(struct sppp *sp, struct lcp_header *h, int len)
SPP_ARGS(ifp));
p = (void*) (h+1);
len = origlen;
- for (rlen=0; len>1 && p[1]; len-=p[1], p+=p[1]) {
+ for (rlen=0; len >= 2 && p[1] >= 2 && len >= p[1];
+ len-=p[1], p+=p[1]) {
if (debug)
log(-1, " %s ", sppp_ipcp_opt_name(*p));
switch (*p) {
@@ -3206,7 +3212,8 @@ sppp_ipcp_RCN_rej(struct sppp *sp, struct lcp_header *h, int len)
SPP_ARGS(ifp));
p = (void*) (h+1);
- for (; len > 1 && p[1]; len -= p[1], p += p[1]) {
+ for (; len >= 2 && p[1] >= 2 && len >= p[1];
+ len -= p[1], p += p[1]) {
if (debug)
log(-1, " %s ", sppp_ipcp_opt_name(*p));
switch (*p) {
@@ -3252,7 +3259,8 @@ sppp_ipcp_RCN_nak(struct sppp *sp, struct lcp_header *h, int len)
SPP_ARGS(ifp));
p = (void*) (h+1);
- for (; len > 1 && p[1]; len -= p[1], p += p[1]) {
+ for (; len >= 2 && p[1] >= 2 && len >= p[1];
+ len -= p[1], p += p[1]) {
if (debug)
log(-1, " %s ", sppp_ipcp_opt_name(*p));
switch (*p) {
@@ -3478,7 +3486,8 @@ sppp_ipv6cp_RCR(struct sppp *sp, struct lcp_header *h, int len)
SPP_ARGS(ifp));
p = (void*) (h+1);
ifidcount = 0;
- for (rlen=0; len>1 && p[1]; len-=p[1], p+=p[1]) {
+ for (rlen=0; len >= 2 && p[1] >= 2 && len >= p[1];
+ len-=p[1], p+=p[1]) {
if (debug)
log(-1, " %s", sppp_ipv6cp_opt_name(*p));
switch (*p) {
@@ -3528,7 +3537,8 @@ sppp_ipv6cp_RCR(struct sppp *sp, struct lcp_header *h, int len)
p = (void*) (h+1);
len = origlen;
type = CONF_ACK;
- for (rlen=0; len>1 && p[1]; len-=p[1], p+=p[1]) {
+ for (rlen=0; len >= 2 && p[1] >= 2 && len >= p[1];
+ len-=p[1], p+=p[1]) {
if (debug)
log(-1, " %s", sppp_ipv6cp_opt_name(*p));
switch (*p) {
@@ -3627,7 +3637,8 @@ sppp_ipv6cp_RCN_rej(struct sppp *sp, struct lcp_header *h, int len)
SPP_ARGS(ifp));
p = (void*) (h+1);
- for (; len > 1 && p[1]; len -= p[1], p += p[1]) {
+ for (; len >= 2 && p[1] >= 2 && len >= p[1];
+ len -= p[1], p += p[1]) {
if (debug)
log(-1, " %s", sppp_ipv6cp_opt_name(*p));
switch (*p) {
@@ -3673,7 +3684,8 @@ sppp_ipv6cp_RCN_nak(struct sppp *sp, struct lcp_header *h, int len)
SPP_ARGS(ifp));
p = (void*) (h+1);
- for (; len > 1 && p[1]; len -= p[1], p += p[1]) {
+ for (; len >= 2 && p[1] >= 2 && len >= p[1];
+ len -= p[1], p += p[1]) {
if (debug)
log(-1, " %s", sppp_ipv6cp_opt_name(*p));
switch (*p) {