pppd: ipxcp: Prevent buffer overrun on remote router name

This fixes an if condition to prevent a possible 1-byte overrun
on ipxcp_hisoptions[0].name.

Reported-by: "Sabas Rosales, Blanca E" <blanca.e.sabas.rosales@intel.com>
Signed-off-by: Paul Mackerras <paulus@ozlabs.org>

diff --git a/pppd/ipxcp.c b/pppd/ipxcp.c
index 7b2343e155377120273793d3be2ce2cf28daff29..aaff10f76200fd65799edb2e45c0a506c2147933 100644 (file)
--- a/pppd/ipxcp.c
+++ b/pppd/ipxcp.c
@@ -1194,7 +1194,7 @@ ipxcp_reqci(f, inp, len, reject_if_disagree)
        case IPX_ROUTER_NAME:
            if (cilen >= CILEN_NAME) {
                int name_size = cilen - CILEN_NAME;
-               if (name_size > sizeof (ho->name))
+               if (name_size >= sizeof (ho->name))
                    name_size = sizeof (ho->name) - 1;
                memset (ho->name, 0, sizeof (ho->name));
                memcpy (ho->name, p, name_size);