plugins/radius: Eliminate some potential buffer overruns

[ppp.git] / pppd / plugins / radius / avpair.c

diff --git a/pppd/plugins/radius/avpair.c b/pppd/plugins/radius/avpair.c
index ebc1895c0a6900d79e8d799e596e1169dcaad8e4..d548b47b1d23bd5ecc4c56b6ad2081a2068463dc 100644 (file)
--- a/pppd/plugins/radius/avpair.c
+++ b/pppd/plugins/radius/avpair.c
@@ -175,12 +175,12 @@ VALUE_PAIR *rc_avpair_gen (AUTH_HDR *auth)
        {
                attribute = *ptr++;
                attrlen = *ptr++;
-               attrlen -= 2;
-               if (attrlen < 0)
+               if (attrlen < 2 || attrlen > length)
                {
                        error("rc_avpair_gen: received attribute with invalid length");
                        break;
                }
+               attrlen -= 2;
 
                /* Handle vendor-specific specially */
                if (attribute == PW_VENDOR_SPECIFIC) {
@@ -222,6 +222,9 @@ VALUE_PAIR *rc_avpair_gen (AUTH_HDR *auth)
                        {
 
                            case PW_TYPE_STRING:
+                           case PW_TYPE_IFID:
+                           case PW_TYPE_IPV6ADDR:
+                           case PW_TYPE_IPV6PREFIX:
                                memcpy (pair->strvalue, (char *) ptr, (size_t) attrlen);
                                pair->strvalue[attrlen] = '\0';
                                pair->lvalue = attrlen;
@@ -692,9 +695,10 @@ int rc_avpair_parse (char *buffer, VALUE_PAIR **first_pair)
 int rc_avpair_tostr (VALUE_PAIR *pair, char *name, int ln, char *value, int lv)
 {
        DICT_VALUE     *dval;
-       char            buffer[32];
+       char            buffer[INET6_ADDRSTRLEN + 4]; // for a prefix: addr + '/' + prefixlen
        struct in_addr  inad;
        unsigned char         *ptr;
+       char            *str;
 
        *name = *value = '\0';
 
@@ -753,6 +757,26 @@ int rc_avpair_tostr (VALUE_PAIR *pair, char *name, int ln, char *value, int lv)
                strncpy(value, buffer, lv-1);
                break;
 
+           case PW_TYPE_IFID:
+               ptr = pair->strvalue;
+               snprintf(buffer, sizeof (buffer), "%x:%x:%x:%x",
+                        (ptr[0] << 8) + ptr[1], (ptr[2] << 8) + ptr[3],
+                        (ptr[4] << 8) + ptr[5], (ptr[6] << 8) + ptr[7]);
+               strncpy(value, buffer, lv-1);
+               break;
+
+           case PW_TYPE_IPV6ADDR:
+               inet_ntop(AF_INET6, pair->strvalue, buffer, sizeof (buffer));
+               strncpy(value, buffer, lv-1);
+               break;
+
+           case PW_TYPE_IPV6PREFIX:
+               inet_ntop(AF_INET6, pair->strvalue + 2, buffer, sizeof (buffer));
+               str = buffer + strlen(buffer);
+               snprintf(str, sizeof (buffer) - (str - buffer), "/%d", *(pair->strvalue + 1));
+               strncpy(value, buffer, lv-1);
+               break;
+
            default:
                error("rc_avpair_tostr: unknown attribute type %d", pair->type);
                return (-1);