Fix out-of-bounds accesses to ZPasswordHash arrays (#395)

[ppp.git] / pppd / lcp.c

diff --git a/pppd/lcp.c b/pppd/lcp.c
index ac5d5ce6488416afefde82633d969c7bc352a502..c72c2ef90bb2dc10cc3970b08059ea11344016e0 100644 (file)
--- a/pppd/lcp.c
+++ b/pppd/lcp.c
@@ -40,16 +40,22 @@
  * OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
 #include <stdio.h>
 #include <string.h>
 #include <stdlib.h>
 
-#include "pppd.h"
+#include "pppd-private.h"
+#include "options.h"
 #include "fsm.h"
 #include "lcp.h"
-#include "chap-new.h"
+#include "eap.h"
+#include "chap.h"
 #include "magic.h"
-
+#include "multilink.h"
 
 /*
  * When the link comes up we want to be able to wait for a short while,
@@ -72,12 +78,12 @@ bool        noendpoint = 0;         /* don't send/accept endpoint discriminator */
 
 static int noopt(char **);
 
-#ifdef HAVE_MULTILINK
+#ifdef PPP_WITH_MULTILINK
 static int setendpoint(char **);
 static void printendpoint(option_t *, void (*)(void *, char *, ...), void *);
-#endif /* HAVE_MULTILINK */
+#endif /* PPP_WITH_MULTILINK */
 
-static option_t lcp_option_list[] = {
+static struct option lcp_option_list[] = {
     /* LCP options */
     { "-all", o_special_noarg, (void *)noopt,
       "Don't request/allow any LCP options" },
@@ -158,7 +164,7 @@ static option_t lcp_option_list[] = {
     { "receive-all", o_bool, &lax_recv,
       "Accept all received control characters", 1 },
 
-#ifdef HAVE_MULTILINK
+#ifdef PPP_WITH_MULTILINK
     { "mrru", o_int, &lcp_wantoptions[0].mrru,
       "Maximum received packet size for multilink bundle",
       OPT_PRIO, &lcp_wantoptions[0].neg_mrru },
@@ -173,7 +179,7 @@ static option_t lcp_option_list[] = {
     { "endpoint", o_special, (void *) setendpoint,
       "Endpoint discriminator for multilink",
       OPT_PRIO | OPT_A2PRINTER, (void *) printendpoint },
-#endif /* HAVE_MULTILINK */
+#endif /* PPP_WITH_MULTILINK */
 
     { "noendpoint", o_bool, &noendpoint,
       "Don't send or accept multilink endpoint discriminator", 1 },
@@ -299,7 +305,7 @@ noopt(char **argv)
     return (1);
 }
 
-#ifdef HAVE_MULTILINK
+#ifdef PPP_WITH_MULTILINK
 static int
 setendpoint(char **argv)
 {
@@ -307,7 +313,7 @@ setendpoint(char **argv)
        lcp_wantoptions[0].neg_endpoint = 1;
        return 1;
     }
-    option_error("Can't parse '%s' as an endpoint discriminator", *argv);
+    ppp_option_error("Can't parse '%s' as an endpoint discriminator", *argv);
     return 0;
 }
 
@@ -316,7 +322,7 @@ printendpoint(option_t *opt, void (*printer)(void *, char *, ...), void *arg)
 {
        printer(arg, "%s", epdisc_to_str(&lcp_wantoptions[0].endpoint));
 }
-#endif /* HAVE_MULTILINK */
+#endif /* PPP_WITH_MULTILINK */
 
 /*
  * lcp_init - Initialize LCP.
@@ -384,11 +390,11 @@ lcp_close(int unit, char *reason)
     fsm *f = &lcp_fsm[unit];
     int oldstate;
 
-    if (phase != PHASE_DEAD && phase != PHASE_MASTER)
+    if (!in_phase(PHASE_DEAD) && !in_phase(PHASE_MASTER))
        new_phase(PHASE_TERMINATE);
 
     if (f->flags & DELAYED_UP) {
-       untimeout(lcp_delayed_up, f);
+       UNTIMEOUT(lcp_delayed_up, f);
        f->state = STOPPED;
     }
     oldstate = f->state;
@@ -430,7 +436,7 @@ lcp_lowerup(int unit)
 
     if (listen_time != 0) {
        f->flags |= DELAYED_UP;
-       timeout(lcp_delayed_up, f, 0, listen_time * 1000);
+       ppp_timeout(lcp_delayed_up, f, 0, listen_time * 1000);
     } else
        fsm_lowerup(f);
 }
@@ -446,7 +452,7 @@ lcp_lowerdown(int unit)
 
     if (f->flags & DELAYED_UP) {
        f->flags &= ~DELAYED_UP;
-       untimeout(lcp_delayed_up, f);
+       UNTIMEOUT(lcp_delayed_up, f);
     } else
        fsm_lowerdown(&lcp_fsm[unit]);
 }
@@ -477,7 +483,7 @@ lcp_input(int unit, u_char *p, int len)
 
     if (f->flags & DELAYED_UP) {
        f->flags &= ~DELAYED_UP;
-       untimeout(lcp_delayed_up, f);
+       UNTIMEOUT(lcp_delayed_up, f);
        fsm_lowerup(f);
     }
     fsm_input(f, p, len);
@@ -1271,7 +1277,7 @@ lcp_nakci(fsm *f, u_char *p, int len, int treat_as_reject)
        if (looped_back) {
            if (++try.numloops >= lcp_loopbackfail) {
                notice("Serial line is looped back.");
-               status = EXIT_LOOPBACK;
+               ppp_set_status(EXIT_LOOPBACK);
                lcp_close(f->unit, "Loopback detected");
            }
        } else
@@ -1864,10 +1870,10 @@ lcp_up(fsm *f)
      */
     mtu = ho->neg_mru? ho->mru: PPP_MRU;
     mru = go->neg_mru? MAX(wo->mru, go->mru): PPP_MRU;
-#ifdef HAVE_MULTILINK
+#ifdef PPP_WITH_MULTILINK
     if (!(multilink && go->neg_mrru && ho->neg_mrru))
-#endif /* HAVE_MULTILINK */
-       netif_set_mtu(f->unit, MIN(MIN(mtu, mru), ao->mru));
+#endif /* PPP_WITH_MULTILINK */
+       ppp_set_mtu(f->unit, MIN(MIN(mtu, mru), ao->mru));
     ppp_send_config(f->unit, mtu,
                    (ho->neg_asyncmap? ho->asyncmap: 0xffffffff),
                    ho->neg_pcompression, ho->neg_accompression);
@@ -2088,7 +2094,7 @@ lcp_printpkt(u_char *p, int plen, void (*printer)(void *, char *, ...), void *ar
                }
                break;
            case CI_EPDISC:
-#ifdef HAVE_MULTILINK
+#ifdef PPP_WITH_MULTILINK
                if (olen >= CILEN_CHAR) {
                    struct epdisc epd;
                    p += 2;
@@ -2181,7 +2187,7 @@ void LcpLinkFailure (fsm *f)
     if (f->state == OPENED) {
        info("No response to %d echo-requests", lcp_echos_pending);
         notice("Serial link appears to be disconnected.");
-       status = EXIT_PEER_DEAD;
+       ppp_set_status(EXIT_PEER_DEAD);
        lcp_close(f->unit, "Peer not responding");
     }
 }
@@ -2274,6 +2280,8 @@ LcpSendEchoRequest (fsm *f)
 
        if (get_ppp_stats(f->unit, &cur_stats) && cur_stats.pkts_in != last_pkts_in) {
            last_pkts_in = cur_stats.pkts_in;
+           /* receipt of traffic indicates the link is working... */
+           lcp_echos_pending = 0;
            return;
        }
     }