pppd: Fix segfault in update_db_entry()

[ppp.git] / pppd / ipxcp.c

diff --git a/pppd/ipxcp.c b/pppd/ipxcp.c
index 8fc05393d618d205d588230d7d2ba44c3d92911b..7b2343e155377120273793d3be2ce2cf28daff29 100644 (file)
--- a/pppd/ipxcp.c
+++ b/pppd/ipxcp.c
@@ -42,7 +42,7 @@
 
 #ifdef IPX_CHANGE
 
-#define RCSID  "$Id: ipxcp.c,v 1.21 2002/12/04 23:03:32 paulus Exp $"
+#define RCSID  "$Id: ipxcp.c,v 1.24 2005/08/25 23:59:34 paulus Exp $"
 
 /*
  * TODO:
@@ -82,7 +82,7 @@ static void ipxcp_resetci __P((fsm *));       /* Reset our CI */
 static int  ipxcp_cilen __P((fsm *));          /* Return length of our CI */
 static void ipxcp_addci __P((fsm *, u_char *, int *)); /* Add our CI */
 static int  ipxcp_ackci __P((fsm *, u_char *, int));   /* Peer ack'd our CI */
-static int  ipxcp_nakci __P((fsm *, u_char *, int));   /* Peer nak'd our CI */
+static int  ipxcp_nakci __P((fsm *, u_char *, int, int));/* Peer nak'd our CI */
 static int  ipxcp_rejci __P((fsm *, u_char *, int));   /* Peer rej'd our CI */
 static int  ipxcp_reqci __P((fsm *, u_char *, int *, int)); /* Rcv CI */
 static void ipxcp_up __P((fsm *));             /* We're UP */
@@ -289,7 +289,7 @@ static int
 setipxnode(argv)
     char **argv;
 {
-    char *end;
+    u_char *end;
     int have_his = 0;
     u_char our_node[6];
     u_char his_node[6];
@@ -343,7 +343,7 @@ static int
 setipxname (argv)
     char **argv;
 {
-    char *dest = ipxcp_wantoptions[0].name;
+    u_char *dest = ipxcp_wantoptions[0].name;
     char *src  = *argv;
     int  count;
     char ch;
@@ -593,7 +593,7 @@ ipxcp_cilen(f)
 
     len         = go->neg_nn       ? CILEN_NETN     : 0;
     len += go->neg_node            ? CILEN_NODEN    : 0;
-    len += go->neg_name            ? CILEN_NAME + strlen (go->name) - 1 : 0;
+    len += go->neg_name            ? CILEN_NAME + strlen ((char *)go->name) - 1 : 0;
 
     /* RFC says that defaults should not be included. */
     if (go->neg_router && to_external(go->router) != RIP_SAP)
@@ -630,7 +630,7 @@ ipxcp_addci(f, ucp, lenp)
     }
 
     if (go->neg_name) {
-       int cilen = strlen (go->name);
+           int cilen = strlen ((char *)go->name);
        int indx;
        PUTCHAR (IPX_ROUTER_NAME, ucp);
        PUTCHAR (CILEN_NAME + cilen - 1, ucp);
@@ -699,7 +699,7 @@ ipxcp_ackci(f, p, len)
     }
 
 #define ACKCINODE(opt,neg,val) ACKCICHARS(opt,neg,val,sizeof(val))
-#define ACKCINAME(opt,neg,val) ACKCICHARS(opt,neg,val,strlen(val))
+#define ACKCINAME(opt,neg,val) ACKCICHARS(opt,neg,val,strlen((char *)val))
 
 #define ACKCINETWORK(opt, neg, val) \
     if (neg) { \
@@ -763,10 +763,11 @@ ipxcp_ackci(f, p, len)
  */
 
 static int
-ipxcp_nakci(f, p, len)
+ipxcp_nakci(f, p, len, treat_as_reject)
     fsm *f;
     u_char *p;
     int len;
+    int treat_as_reject;
 {
     u_char citype, cilen, *next;
     u_short s;
@@ -777,11 +778,11 @@ ipxcp_nakci(f, p, len)
     BZERO(&no, sizeof(no));
     try = *go;
 
-    while (len > CILEN_VOID) {
+    while (len >= CILEN_VOID) {
        GETCHAR (citype, p);
        GETCHAR (cilen,  p);
        len -= cilen;
-       if (len < 0)
+       if (cilen < CILEN_VOID || len < 0)
            goto bad;
        next = &p [cilen - CILEN_VOID];
 
@@ -792,7 +793,9 @@ ipxcp_nakci(f, p, len)
            no.neg_nn = 1;
 
            GETLONG(l, p);
-           if (l && ao->accept_network)
+           if (treat_as_reject)
+               try.neg_nn = 0;
+           else if (l && ao->accept_network)
                try.our_network = l;
            break;
 
@@ -801,8 +804,10 @@ ipxcp_nakci(f, p, len)
                goto bad;
            no.neg_node = 1;
 
-           if (!zero_node (p) && ao->accept_local &&
-               ! compare_node (p, ho->his_node))
+           if (treat_as_reject)
+               try.neg_node = 0;
+           else if (!zero_node (p) && ao->accept_local &&
+                    ! compare_node (p, ho->his_node))
                copy_node (p, try.our_node);
            break;
 
@@ -918,7 +923,7 @@ ipxcp_rejci(f, p, len)
     }
 
 #define REJCINODE(opt,neg,val) REJCICHARS(opt,neg,val,sizeof(val))
-#define REJCINAME(opt,neg,val) REJCICHARS(opt,neg,val,strlen(val))
+#define REJCINAME(opt,neg,val) REJCICHARS(opt,neg,val,strlen((char *)val))
 
 #define REJCIVOID(opt, neg) \
     if (neg && p[0] == opt) { \
@@ -1448,12 +1453,12 @@ ipxcp_script(f, script)
     argv[6]  = strremote;
     argv[7]  = strproto_lcl;
     argv[8]  = strproto_rmt;
-    argv[9]  = go->name;
-    argv[10] = ho->name;
+    argv[9]  = (char *)go->name;
+    argv[10] = (char *)ho->name;
     argv[11] = ipparam;
     argv[12] = strpid;
     argv[13] = NULL;
-    run_program(script, argv, 0, NULL, NULL);
+    run_program(script, argv, 0, NULL, NULL, 0);
 }
 
 /*
@@ -1575,7 +1580,7 @@ ipxcp_printpkt(p, plen, printer, arg)
     case TERMREQ:
        if (len > 0 && *p >= ' ' && *p < 0x7f) {
            printer(arg, " ");
-           print_string(p, len, printer, arg);
+           print_string((char *)p, len, printer, arg);
            p += len;
            len = 0;
        }