plugins/rp-pppoe: Make tag parsing loop condition more accurate

[ppp.git] / pppd / plugins / rp-pppoe / common.c

diff --git a/pppd/plugins/rp-pppoe/common.c b/pppd/plugins/rp-pppoe/common.c
index 8f175ece345b67bb4d276131aa97f1fce139d31c..9ea7fd609c8774aafbaf2cbe9bb6a6d86679b516 100644 (file)
--- a/pppd/plugins/rp-pppoe/common.c
+++ b/pppd/plugins/rp-pppoe/common.c
@@ -65,7 +65,7 @@ parsePacket(PPPoEPacket *packet, ParseFunc *func, void *extra)
 
     /* Step through the tags */
     curTag = packet->payload;
 
     /* Step through the tags */
     curTag = packet->payload;

-    while(curTag - packet->payload < len) {
+    while (curTag - packet->payload + TAG_HDR_SIZE <= len) {

        /* Alignment is not guaranteed, so do this by hand... */
        tagType = (curTag[0] << 8) + curTag[1];
        tagLen = (curTag[2] << 8) + curTag[3];
        /* Alignment is not guaranteed, so do this by hand... */
        tagType = (curTag[0] << 8) + curTag[1];
        tagLen = (curTag[2] << 8) + curTag[3];