pppd: Eliminate potential integer overflow in option parsing

[ppp.git] / pppd / options.c

diff --git a/pppd/options.c b/pppd/options.c
index 45fa742cd9ce9d095490ebc68fa199023f8da8cc..e9042d1f64e2b5bbf05c74a91587f049f011c2b8 100644 (file)
--- a/pppd/options.c
+++ b/pppd/options.c
@@ -1289,9 +1289,10 @@ getword(f, word, newlinep, filename)
            /*
             * Store the resulting character for the escape sequence.
             */
-           if (len < MAXWORDLEN-1)
+           if (len < MAXWORDLEN) {
                word[len] = value;
-           ++len;
+               ++len;
+           }
 
            if (!got)
                c = getc(f);
@@ -1329,9 +1330,10 @@ getword(f, word, newlinep, filename)
        /*
         * An ordinary character: store it in the word and get another.
         */
-       if (len < MAXWORDLEN-1)
+       if (len < MAXWORDLEN) {
            word[len] = c;
-       ++len;
+           ++len;
+       }
 
        c = getc(f);
     }