Print this page 
5378 CVE-2014-3158 ppp: integer overflow in option parsing
Reviewed by: Robert Mustacchi <rm@joyent.com>
Split Close
Expand all
Collapse all
          --- old/usr/src/cmd/cmd-inet/usr.bin/pppd/options.c
          +++ new/usr/src/cmd/cmd-inet/usr.bin/pppd/options.c
↓ open down ↓ 23 lines elided ↑ open up ↑ 
  24   24   * advertising materials, and other materials related to such
  25   25   * distribution and use acknowledge that the software was developed
  26   26   * by Carnegie Mellon University.  The name of the
  27   27   * University may not be used to endorse or promote products derived
  28   28   * from this software without specific prior written permission.
  29   29   * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR
  30   30   * IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED
  31   31   * WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE.
  32   32   */
  33   33  
  34      -#pragma ident   "%Z%%M% %I%     %E% SMI"
  35   34  #define RCSID   "$Id: options.c,v 1.74 2000/04/15 01:27:13 masputra Exp $"
  36   35  
  37   36  #include <ctype.h>
  38   37  #include <stdio.h>
  39   38  #include <errno.h>
  40   39  #include <unistd.h>
  41   40  #include <fcntl.h>
  42   41  #include <stdlib.h>
  43   42  #include <syslog.h>
  44   43  #include <string.h>
↓ open down ↓ 1263 lines elided ↑ open up ↑ 
1308 1307                  /*
1309 1308                   * Otherwise the character stands for itself.
1310 1309                   */
1311 1310                  value = c;
1312 1311                  break;
1313 1312              }
1314 1313  
1315 1314              /*
1316 1315               * Store the resulting character for the escape sequence.
1317 1316               */
1318      -            if (len < MAXWORDLEN-1)
     1317 +            if (len < MAXWORDLEN) {
1319 1318                  word[len] = value;
1320      -            ++len;
     1319 +                ++len;
     1320 +            }
1321 1321  
1322 1322              if (!got)
1323 1323                  c = getc(f);
1324 1324              continue;
1325 1325  
1326 1326          }
1327 1327  
1328 1328          /*
1329 1329           * Not escaped: see if we've reached the end of the word.
1330 1330           */
↓ open down ↓ 12 lines elided ↑ open up ↑ 
1343 1343           */
1344 1344          if (c == '\\') {
1345 1345              escape = 1;
1346 1346              c = getc(f);
1347 1347              continue;
1348 1348          }
1349 1349  
1350 1350          /*
1351 1351           * An ordinary character: store it in the word and get another.
1352 1352           */
1353      -        if (len < MAXWORDLEN-1)
     1353 +        if (len < MAXWORDLEN) {
1354 1354              word[len] = c;
1355      -        ++len;
     1355 +            ++len;
     1356 +        }
1356 1357  
1357 1358          c = getc(f);
1358 1359      }
1359 1360  
1360 1361      /*
1361 1362       * End of the word: check for errors.
1362 1363       */
1363 1364      if (c == EOF) {
1364 1365          if (ferror(f)) {
1365 1366              if (errno == 0)
↓ open down ↓ 641 lines elided ↑ open up ↑ 
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX