Skip to content

A
accel-ppp

Achou.Wang / accel-ppp

通知 6
Star 1
Fork 0
A
accel-ppp

前往新版Gitcode，体验更适合开发者的 AI 搜索 >>

提交 03c5bd91 编写于 作者: K Kozlov Dmitry
浏览文件
操作

ppp: options header sanity check

上级 676a6f6e
隐藏空白更改
内联 并排
Showing with 61 addition and 27 deletion
accel-pppd/ppp/ppp_ccp.c
浏览文件 @ 03c5bd91
......@@ -387,20 +387,19 @@ static int ccp_recv_conf_req(struct ppp_ccp_t *ccp, uint8_t *data, int size)
while (size > 0) {
hdr = (struct ccp_opt_hdr_t *)data;
if (!hdr->len || hdr->len > size)
break;
ropt = _malloc(sizeof(*ropt));
memset(ropt, 0, sizeof(*ropt));
if (hdr->len > size)
ropt->len = size;
else
ropt->len = hdr->len;
ropt->hdr = hdr;
ropt->len = hdr->len;
ropt->state = CCP_OPT_NONE;
list_add_tail(&ropt->entry, &ccp->ropt_list);
data += ropt->len;
size -= ropt->len;
data += hdr->len;
size -= hdr->len;
}
if (conf_ppp_verbose)
......@@ -483,6 +482,9 @@ static int ccp_recv_conf_rej(struct ppp_ccp_t *ccp, uint8_t *data, int size)
while (size > 0) {
hdr = (struct ccp_opt_hdr_t *)data;
if (!hdr->len || hdr->len > size)
break;
list_for_each_entry(lopt, &ccp->options, entry) {
if (lopt->id == hdr->id) {
if (!lopt->h->recv_conf_rej)
......@@ -521,6 +523,9 @@ static int ccp_recv_conf_nak(struct ppp_ccp_t *ccp, uint8_t *data, int size)
while (size > 0) {
hdr = (struct ccp_opt_hdr_t *)data;
if (!hdr->len || hdr->len > size)
break;
list_for_each_entry(lopt, &ccp->options, entry) {
if (lopt->id == hdr->id) {
if (conf_ppp_verbose) {
......@@ -561,6 +566,9 @@ static int ccp_recv_conf_ack(struct ppp_ccp_t *ccp, uint8_t *data, int size)
while (size > 0) {
hdr = (struct ccp_opt_hdr_t *)data;
if (!hdr->len || hdr->len > size)
break;
list_for_each_entry(lopt, &ccp->options, entry) {
if (lopt->id == hdr->id) {
if (conf_ppp_verbose) {
......
accel-pppd/ppp/ppp_ipcp.c
浏览文件 @ 03c5bd91
......@@ -392,19 +392,19 @@ static int ipcp_recv_conf_req(struct ppp_ipcp_t *ipcp, uint8_t *data, int size)
while (size > 0) {
hdr = (struct ipcp_opt_hdr_t *)data;
if (!hdr->len || hdr->len > size)
break;
ropt = _malloc(sizeof(*ropt));
memset(ropt, 0, sizeof(*ropt));
if (hdr->len > size)
ropt->len = size;
else
ropt->len = hdr->len;
ropt->hdr = hdr;
ropt->len = hdr->len;
ropt->state = IPCP_OPT_NONE;
list_add_tail(&ropt->entry, &ipcp->ropt_list);
data += ropt->len;
size -= ropt->len;
data += hdr->len;
size -= hdr->len;
}
list_for_each_entry(lopt, &ipcp->options, entry)
......@@ -504,6 +504,9 @@ static int ipcp_recv_conf_rej(struct ppp_ipcp_t *ipcp, uint8_t *data, int size)
while (size > 0) {
hdr = (struct ipcp_opt_hdr_t *)data;
if (!hdr->len || hdr->len > size)
break;
list_for_each_entry(lopt, &ipcp->options, entry) {
if (lopt->id == hdr->id) {
if (!lopt->h->recv_conf_rej)
......@@ -542,6 +545,9 @@ static int ipcp_recv_conf_nak(struct ppp_ipcp_t *ipcp, uint8_t *data, int size)
while (size > 0) {
hdr = (struct ipcp_opt_hdr_t *)data;
if (!hdr->len || hdr->len > size)
break;
list_for_each_entry(lopt, &ipcp->options, entry) {
if (lopt->id == hdr->id) {
if (conf_ppp_verbose) {
......@@ -582,6 +588,9 @@ static int ipcp_recv_conf_ack(struct ppp_ipcp_t *ipcp, uint8_t *data, int size)
while (size > 0) {
hdr = (struct ipcp_opt_hdr_t *)data;
if (!hdr->len || hdr->len > size)
break;
list_for_each_entry(lopt, &ipcp->options, entry) {
if (lopt->id == hdr->id) {
if (conf_ppp_verbose) {
......
accel-pppd/ppp/ppp_ipv6cp.c
浏览文件 @ 03c5bd91
......@@ -392,19 +392,19 @@ static int ipv6cp_recv_conf_req(struct ppp_ipv6cp_t *ipv6cp, uint8_t *data, int
while (size > 0) {
hdr = (struct ipv6cp_opt_hdr_t *)data;
if (!hdr->len || hdr->len > size)
break;
ropt = _malloc(sizeof(*ropt));
memset(ropt, 0, sizeof(*ropt));
if (hdr->len > size)
ropt->len = size;
else
ropt->len = hdr->len;
ropt->hdr = hdr;
ropt->len = hdr->len;
ropt->state = IPV6CP_OPT_NONE;
list_add_tail(&ropt->entry, &ipv6cp->ropt_list);
data += ropt->len;
size -= ropt->len;
data += hdr->len;
size -= hdr->len;
}
list_for_each_entry(lopt, &ipv6cp->options, entry)
......@@ -504,6 +504,9 @@ static int ipv6cp_recv_conf_rej(struct ppp_ipv6cp_t *ipv6cp, uint8_t *data, int
while (size > 0) {
hdr = (struct ipv6cp_opt_hdr_t *)data;
if (!hdr->len || hdr->len > size)
break;
list_for_each_entry(lopt, &ipv6cp->options, entry) {
if (lopt->id == hdr->id) {
if (!lopt->h->recv_conf_rej)
......@@ -542,6 +545,9 @@ static int ipv6cp_recv_conf_nak(struct ppp_ipv6cp_t *ipv6cp, uint8_t *data, int
while (size > 0) {
hdr = (struct ipv6cp_opt_hdr_t *)data;
if (!hdr->len || hdr->len > size)
break;
list_for_each_entry(lopt, &ipv6cp->options, entry) {
if (lopt->id == hdr->id) {
if (conf_ppp_verbose) {
......@@ -582,6 +588,9 @@ static int ipv6cp_recv_conf_ack(struct ppp_ipv6cp_t *ipv6cp, uint8_t *data, int
while (size > 0) {
hdr = (struct ipv6cp_opt_hdr_t *)data;
if (!hdr->len || hdr->len > size)
break;
list_for_each_entry(lopt, &ipv6cp->options, entry) {
if (lopt->id == hdr->id) {
if (conf_ppp_verbose) {
......
accel-pppd/ppp/ppp_lcp.c
浏览文件 @ 03c5bd91
......@@ -368,20 +368,19 @@ static int lcp_recv_conf_req(struct ppp_lcp_t *lcp, uint8_t *data, int size)
while (size > 0) {
hdr = (struct lcp_opt_hdr_t *)data;
if (!hdr->len || hdr->len > size)
break;
ropt = _malloc(sizeof(*ropt));
memset(ropt, 0, sizeof(*ropt));
if (hdr->len > size)
ropt->len = size;
else
ropt->len = hdr->len;
ropt->hdr = hdr;
ropt->len = hdr->len;
ropt->state = LCP_OPT_NONE;
list_add_tail(&ropt->entry, &lcp->ropt_list);
data += ropt->len;
size -= ropt->len;
data += hdr->len;
size -= hdr->len;
}
list_for_each_entry(lopt, &lcp->options, entry)
......@@ -460,6 +459,9 @@ static int lcp_recv_conf_rej(struct ppp_lcp_t *lcp, uint8_t *data, int size)
while (size > 0) {
hdr = (struct lcp_opt_hdr_t *)data;
if (!hdr->len || hdr->len > size)
break;
list_for_each_entry(lopt, &lcp->options, entry) {
if (lopt->id == hdr->id) {
......@@ -502,6 +504,9 @@ static int lcp_recv_conf_nak(struct ppp_lcp_t *lcp, uint8_t *data, int size)
while (size > 0) {
hdr = (struct lcp_opt_hdr_t *)data;
if (!hdr->len || hdr->len > size)
break;
list_for_each_entry(lopt,&lcp->options,entry) {
if (lopt->id == hdr->id) {
......@@ -542,6 +547,9 @@ static int lcp_recv_conf_ack(struct ppp_lcp_t *lcp, uint8_t *data, int size)
while (size > 0) {
hdr = (struct lcp_opt_hdr_t *)data;
if (!hdr->len || hdr->len > size)
break;
list_for_each_entry(lopt, &lcp->options, entry) {
if (lopt->id == hdr->id) {
......
Markdown is supported
0% 或 .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑！
想要评论请 注册 或