From: Paul Mackerras <paulus@samba.org>
Date: Fri, 14 Aug 2015 07:56:26 +0000 (+1000)
Subject: pppd: ipxcp: Prevent buffer overrun on remote router name
X-Git-Tag: ppp-2.4.8~54
X-Git-Url: http://git.ozlabs.org/?a=commitdiff_plain;h=fe149de624f96629a7f46732055d8f718c74b856;p=ppp.git

pppd: ipxcp: Prevent buffer overrun on remote router name

This fixes an if condition to prevent a possible 1-byte overrun
on ipxcp_hisoptions[0].name.

Reported-by: "Sabas Rosales, Blanca E" <blanca.e.sabas.rosales@intel.com>
Signed-off-by: Paul Mackerras <paulus@ozlabs.org>
---

diff --git a/pppd/ipxcp.c b/pppd/ipxcp.c
index 7b2343e..aaff10f 100644
--- a/pppd/ipxcp.c
+++ b/pppd/ipxcp.c
@@ -1194,7 +1194,7 @@ ipxcp_reqci(f, inp, len, reject_if_disagree)
 	case IPX_ROUTER_NAME:
 	    if (cilen >= CILEN_NAME) {
 		int name_size = cilen - CILEN_NAME;
-		if (name_size > sizeof (ho->name))
+		if (name_size >= sizeof (ho->name))
 		    name_size = sizeof (ho->name) - 1;
 		memset (ho->name, 0, sizeof (ho->name));
 		memcpy (ho->name, p, name_size);