diff options
author | Paul Mackerras <paulus@ozlabs.org> | 2020-04-02 01:58:06 +0000 |
---|---|---|
committer | Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com> | 2020-04-02 01:58:06 +0000 |
commit | e4712fc02b6b2b4645858b8b5270860f7cb9025b (patch) | |
tree | eb1534824b8c971f4195b967e9adb3d2b974ba3b | |
parent | f39a656871ed774e290150e3d007d418858bdb27 (diff) | |
parent | 7bbd97dd7c5f942f5714c17af4bb2aef9fa7b87a (diff) | |
download | ppp-android-11.0.0_r45.tar.gz |
pppd: Fix bounds check in EAP code am: f9fec5c369 am: 0adf11c24c am: 5788de2192 am: 024dbd1dc3 am: 39855b1e5b am: 80896b9c49 am: fdffd0deaf am: 7bbd97dd7candroid-11.0.0_r48android-11.0.0_r47android-11.0.0_r46android-11.0.0_r45android-11.0.0_r44android-11.0.0_r43android-11.0.0_r42android-11.0.0_r41android-11.0.0_r40android-11.0.0_r39android-11.0.0_r38android-11.0.0_r37android-11.0.0_r36android-11.0.0_r35android-11.0.0_r34android-11.0.0_r33android-11.0.0_r32android-11.0.0_r31android-11.0.0_r30android-11.0.0_r29android-11.0.0_r28android-11.0.0_r27android-11.0.0_r26android-11.0.0_r24android-11.0.0_r23android-11.0.0_r22android-11.0.0_r21android-11.0.0_r20android-11.0.0_r19android-11.0.0_r18android11-qpr3-s1-releaseandroid11-qpr3-releaseandroid11-qpr2-releaseandroid11-qpr1-s2-releaseandroid11-qpr1-s1-releaseandroid11-qpr1-releaseandroid11-qpr1-d-s1-releaseandroid11-qpr1-d-releaseandroid11-qpr1-c-releaseandroid11-d2-release
Change-Id: I1fc6a925eb78a02501b0bf584453a9bc6d62e56c
-rw-r--r-- | pppd/eap.c | 4 |
1 files changed, 2 insertions, 2 deletions
@@ -1421,7 +1421,7 @@ int len; } /* Not so likely to happen. */ - if (vallen >= len + sizeof (rhostname)) { + if (len - vallen >= sizeof (rhostname)) { dbglog("EAP: trimming really long peer name down"); BCOPY(inp + vallen, rhostname, sizeof (rhostname) - 1); rhostname[sizeof (rhostname) - 1] = '\0'; @@ -1847,7 +1847,7 @@ int len; } /* Not so likely to happen. */ - if (vallen >= len + sizeof (rhostname)) { + if (len - vallen >= sizeof (rhostname)) { dbglog("EAP: trimming really long peer name down"); BCOPY(inp + vallen, rhostname, sizeof (rhostname) - 1); rhostname[sizeof (rhostname) - 1] = '\0'; |