From 142a8d48924408c4309025f72600b88f9f0510b2 Mon Sep 17 00:00:00 2001 From: Paul Mackerras Date: Tue, 20 Aug 2024 18:21:47 +1000 Subject: [PATCH] pppd: Widen types in ipcp_reqci The reason is to avoid a theoretically possible overflow of cilen. Using u_int32_t rather than u_short probably generates better code on many machines anyway. Also change l from int to unsigned so as to avoid any possibility of integer overflow. Signed-off-by: Paul Mackerras --- pppd/ipcp.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pppd/ipcp.c b/pppd/ipcp.c index 5d9ff11..1cf7f79 100644 --- a/pppd/ipcp.c +++ b/pppd/ipcp.c @@ -1437,14 +1437,14 @@ ipcp_reqci(fsm *f, u_char *inp, int *len, int reject_if_disagree) ipcp_options *ho = &ipcp_hisoptions[f->unit]; ipcp_options *ao = &ipcp_allowoptions[f->unit]; u_char *cip, *next; /* Pointer to current and next CIs */ - u_short cilen, citype; /* Parsed len, type */ + u_int32_t cilen, citype; /* Parsed len, type */ u_short cishort; /* Parsed short value */ u_int32_t tl, ciaddr1, ciaddr2;/* Parsed address values */ int rc = CONFACK; /* Final packet return code */ int orc; /* Individual option return code */ u_char *p; /* Pointer to next char to parse */ u_char *ucp = inp; /* Pointer to current output char */ - int l = *len; /* Length left */ + u_int32_t l = *len; /* Length left */ u_char maxslotindex, cflag; int d; -- 2.39.5