Skip to content

Commit e9d369a

Browse files
committed
radius: sanity check for vendor attribute length
1 parent c8575ff commit e9d369a

File tree

1 file changed

+8
-0
lines changed

1 file changed

+8
-0
lines changed

Diff for: accel-pppd/radius/packet.c

+8
Original file line numberDiff line numberDiff line change
@@ -206,6 +206,14 @@ int rad_packet_recv(int fd, struct rad_packet_t **p, struct sockaddr_in *addr)
206206
len -= vendor->tag + vendor->len;
207207

208208
n -= 4 + vendor->tag + vendor->len;
209+
if (len < 0) {
210+
log_ppp_warn("radius:packet invalid vendor attribute len received\n");
211+
goto out_err;
212+
}
213+
if (2 + len > n) {
214+
log_ppp_warn("radius:packet: too long vendor attribute received (%i, %i)\n", id, len);
215+
goto out_err;
216+
}
209217
} else
210218
log_ppp_warn("radius:packet: vendor %i not found\n", id);
211219
} else

0 commit comments

Comments
 (0)