| From a75fb7b198eed50d769c80c36629f38346882cbf Mon Sep 17 00:00:00 2001 |
| From: Paul Mackerras <paulus@ozlabs.org> |
| Date: Thu, 4 Aug 2022 12:23:08 +1000 |
| Subject: [PATCH] pppdump: Avoid out-of-range access to packet buffer |
| |
| This fixes a potential vulnerability where data is written to spkt.buf |
| and rpkt.buf without a check on the array index. To fix this, we |
| check the array index (pkt->cnt) before storing the byte or |
| incrementing the count. This also means we no longer have a potential |
| signed integer overflow on the increment of pkt->cnt. |
| |
| Fortunately, pppdump is not used in the normal process of setting up a |
| PPP connection, is not installed setuid-root, and is not invoked |
| automatically in any scenario that I am aware of. |
| |
| Signed-off-by: Paul Mackerras <paulus@ozlabs.org> |
| |
| Upstream-Status: Backport |
| Signed-off-by: Ross Burton <ross.burton@arm.com> |
| --- |
| pppdump/pppdump.c | 7 ++++++- |
| 1 file changed, 6 insertions(+), 1 deletion(-) |
| |
| diff --git a/pppdump/pppdump.c b/pppdump/pppdump.c |
| index 2b815fc9..b85a8627 100644 |
| --- a/pppdump/pppdump.c |
| +++ b/pppdump/pppdump.c |
| @@ -297,6 +297,10 @@ dumpppp(f) |
| printf("%s aborted packet:\n ", dir); |
| q = " "; |
| } |
| + if (pkt->cnt >= sizeof(pkt->buf)) { |
| + printf("%s over-long packet truncated:\n ", dir); |
| + q = " "; |
| + } |
| nb = pkt->cnt; |
| p = pkt->buf; |
| pkt->cnt = 0; |
| @@ -400,7 +404,8 @@ dumpppp(f) |
| c ^= 0x20; |
| pkt->esc = 0; |
| } |
| - pkt->buf[pkt->cnt++] = c; |
| + if (pkt->cnt < sizeof(pkt->buf)) |
| + pkt->buf[pkt->cnt++] = c; |
| break; |
| } |
| } |