From: Paul Mackerras Date: Tue, 20 Aug 2024 08:21:47 +0000 (+1000) Subject: pppd: Widen types in ipcp_reqci X-Git-Tag: v2.5.1~22 X-Git-Url: https://git.ozlabs.org/?a=commitdiff_plain;h=142a8d48924408c4309025f72600b88f9f0510b2;p=ppp.git pppd: Widen types in ipcp_reqci The reason is to avoid a theoretically possible overflow of cilen. Using u_int32_t rather than u_short probably generates better code on many machines anyway. Also change l from int to unsigned so as to avoid any possibility of integer overflow. Signed-off-by: Paul Mackerras --- diff --git a/pppd/ipcp.c b/pppd/ipcp.c index 5d9ff11..1cf7f79 100644 --- a/pppd/ipcp.c +++ b/pppd/ipcp.c @@ -1437,14 +1437,14 @@ ipcp_reqci(fsm *f, u_char *inp, int *len, int reject_if_disagree) ipcp_options *ho = &ipcp_hisoptions[f->unit]; ipcp_options *ao = &ipcp_allowoptions[f->unit]; u_char *cip, *next; /* Pointer to current and next CIs */ - u_short cilen, citype; /* Parsed len, type */ + u_int32_t cilen, citype; /* Parsed len, type */ u_short cishort; /* Parsed short value */ u_int32_t tl, ciaddr1, ciaddr2;/* Parsed address values */ int rc = CONFACK; /* Final packet return code */ int orc; /* Individual option return code */ u_char *p; /* Pointer to next char to parse */ u_char *ucp = inp; /* Pointer to current output char */ - int l = *len; /* Length left */ + u_int32_t l = *len; /* Length left */ u_char maxslotindex, cflag; int d;