3571e53040
patches for easier mirroring, to eliminate a special copy, to make www.freebsd.org/security a full copy of security.freebsd.org and be eventually be the same. For now files are just sitting there. The symlinks are missing. Discussed on: www (repository location) Discussed with: simon (so)
127 lines
3.7 KiB
Diff
127 lines
3.7 KiB
Diff
Index: sys/net/if_spppsubr.c
|
|
===================================================================
|
|
RCS file: /home/ncvs/src/sys/net/if_spppsubr.c,v
|
|
retrieving revision 1.113.2.1
|
|
diff -u -I__FBSDID -r1.113.2.1 if_spppsubr.c
|
|
--- sys/net/if_spppsubr.c 15 Sep 2004 15:14:18 -0000 1.113.2.1
|
|
+++ sys/net/if_spppsubr.c 21 Aug 2006 11:49:02 -0000
|
|
@@ -2204,7 +2204,8 @@
|
|
|
|
/* pass 1: check for things that need to be rejected */
|
|
p = (void*) (h+1);
|
|
- for (rlen=0; len>1 && p[1]; len-=p[1], p+=p[1]) {
|
|
+ for (rlen=0; len >= 2 && p[1] >= 2 && len >= p[1];
|
|
+ len-=p[1], p+=p[1]) {
|
|
if (debug)
|
|
log(-1, " %s ", sppp_lcp_opt_name(*p));
|
|
switch (*p) {
|
|
@@ -2283,7 +2284,8 @@
|
|
|
|
p = (void*) (h+1);
|
|
len = origlen;
|
|
- for (rlen=0; len>1 && p[1]; len-=p[1], p+=p[1]) {
|
|
+ for (rlen=0; len >= 2 && p[1] >= 2 && len >= p[1];
|
|
+ len-=p[1], p+=p[1]) {
|
|
if (debug)
|
|
log(-1, " %s ", sppp_lcp_opt_name(*p));
|
|
switch (*p) {
|
|
@@ -2425,7 +2427,8 @@
|
|
SPP_ARGS(ifp));
|
|
|
|
p = (void*) (h+1);
|
|
- for (; len > 1 && p[1]; len -= p[1], p += p[1]) {
|
|
+ for (; len >= 2 && p[1] >= 2 && len >= p[1];
|
|
+ len -= p[1], p += p[1]) {
|
|
if (debug)
|
|
log(-1, " %s ", sppp_lcp_opt_name(*p));
|
|
switch (*p) {
|
|
@@ -2489,7 +2492,8 @@
|
|
SPP_ARGS(ifp));
|
|
|
|
p = (void*) (h+1);
|
|
- for (; len > 1 && p[1]; len -= p[1], p += p[1]) {
|
|
+ for (; len >= 2 && p[1] >= 2 && len >= p[1];
|
|
+ len -= p[1], p += p[1]) {
|
|
if (debug)
|
|
log(-1, " %s ", sppp_lcp_opt_name(*p));
|
|
switch (*p) {
|
|
@@ -2881,7 +2885,8 @@
|
|
log(LOG_DEBUG, SPP_FMT "ipcp parse opts: ",
|
|
SPP_ARGS(ifp));
|
|
p = (void*) (h+1);
|
|
- for (rlen=0; len>1 && p[1]; len-=p[1], p+=p[1]) {
|
|
+ for (rlen=0; len >= 2 && p[1] >= 2 && len >= p[1];
|
|
+ len-=p[1], p+=p[1]) {
|
|
if (debug)
|
|
log(-1, " %s ", sppp_ipcp_opt_name(*p));
|
|
switch (*p) {
|
|
@@ -2950,7 +2955,8 @@
|
|
SPP_ARGS(ifp));
|
|
p = (void*) (h+1);
|
|
len = origlen;
|
|
- for (rlen=0; len>1 && p[1]; len-=p[1], p+=p[1]) {
|
|
+ for (rlen=0; len >= 2 && p[1] >= 2 && len >= p[1];
|
|
+ len-=p[1], p+=p[1]) {
|
|
if (debug)
|
|
log(-1, " %s ", sppp_ipcp_opt_name(*p));
|
|
switch (*p) {
|
|
@@ -3081,7 +3087,8 @@
|
|
SPP_ARGS(ifp));
|
|
|
|
p = (void*) (h+1);
|
|
- for (; len > 1 && p[1]; len -= p[1], p += p[1]) {
|
|
+ for (; len >= 2 && p[1] >= 2 && len >= p[1];
|
|
+ len -= p[1], p += p[1]) {
|
|
if (debug)
|
|
log(-1, " %s ", sppp_ipcp_opt_name(*p));
|
|
switch (*p) {
|
|
@@ -3127,7 +3134,8 @@
|
|
SPP_ARGS(ifp));
|
|
|
|
p = (void*) (h+1);
|
|
- for (; len > 1 && p[1]; len -= p[1], p += p[1]) {
|
|
+ for (; len >= 2 && p[1] >= 2 && len >= p[1];
|
|
+ len -= p[1], p += p[1]) {
|
|
if (debug)
|
|
log(-1, " %s ", sppp_ipcp_opt_name(*p));
|
|
switch (*p) {
|
|
@@ -3357,7 +3365,8 @@
|
|
SPP_ARGS(ifp));
|
|
p = (void*) (h+1);
|
|
ifidcount = 0;
|
|
- for (rlen=0; len>1 && p[1]; len-=p[1], p+=p[1]) {
|
|
+ for (rlen=0; len >= 2 && p[1] >= 2 && len >= p[1];
|
|
+ len-=p[1], p+=p[1]) {
|
|
if (debug)
|
|
log(-1, " %s", sppp_ipv6cp_opt_name(*p));
|
|
switch (*p) {
|
|
@@ -3407,7 +3416,8 @@
|
|
p = (void*) (h+1);
|
|
len = origlen;
|
|
type = CONF_ACK;
|
|
- for (rlen=0; len>1 && p[1]; len-=p[1], p+=p[1]) {
|
|
+ for (rlen=0; len >= 2 && p[1] >= 2 && len >= p[1];
|
|
+ len-=p[1], p+=p[1]) {
|
|
if (debug)
|
|
log(-1, " %s", sppp_ipv6cp_opt_name(*p));
|
|
switch (*p) {
|
|
@@ -3506,7 +3516,8 @@
|
|
SPP_ARGS(ifp));
|
|
|
|
p = (void*) (h+1);
|
|
- for (; len > 1 && p[1]; len -= p[1], p += p[1]) {
|
|
+ for (; len >= 2 && p[1] >= 2 && len >= p[1];
|
|
+ len -= p[1], p += p[1]) {
|
|
if (debug)
|
|
log(-1, " %s", sppp_ipv6cp_opt_name(*p));
|
|
switch (*p) {
|
|
@@ -3552,7 +3563,8 @@
|
|
SPP_ARGS(ifp));
|
|
|
|
p = (void*) (h+1);
|
|
- for (; len > 1 && p[1]; len -= p[1], p += p[1]) {
|
|
+ for (; len >= 2 && p[1] >= 2 && len >= p[1];
|
|
+ len -= p[1], p += p[1]) {
|
|
if (debug)
|
|
log(-1, " %s", sppp_ipv6cp_opt_name(*p));
|
|
switch (*p) {
|