From: Paul Mackerras <paulus@ozlabs.org>
Date: Sat, 4 Jan 2020 01:01:32 +0000 (+1100)
Subject: radius: Prevent buffer overflow in rc_mksid()
X-Git-Tag: ppp-2.4.9~70
X-Git-Url: https://git.ozlabs.org/?p=ppp.git;a=commitdiff_plain;h=858976b1fc3107f1261aae337831959b511b83c2

radius: Prevent buffer overflow in rc_mksid()

On some systems getpid() can return a value greater than 65535.
Increase the size of buf[] to allow for this, and use slprintf()
to make sure we never overflow it.

Signed-off-by: Paul Mackerras <paulus@ozlabs.org>
---

diff --git a/pppd/plugins/radius/util.c b/pppd/plugins/radius/util.c
index 6f976a7..740131e 100644
--- a/pppd/plugins/radius/util.c
+++ b/pppd/plugins/radius/util.c
@@ -73,9 +73,9 @@ void rc_mdelay(int msecs)
 char *
 rc_mksid (void)
 {
-  static char buf[15];
+  static char buf[32];
   static unsigned short int cnt = 0;
-  sprintf (buf, "%08lX%04X%02hX",
+  slprintf(buf, sizeof(buf), "%08lX%04X%02hX",
 	   (unsigned long int) time (NULL),
 	   (unsigned int) getpid (),
 	   cnt & 0xFF);