commit de97b8f909394ed259a7155a268e3b5784f32d88
author Paul Mackerras <paulus@ozlabs.org> Mon Feb 03 15:53:28 2020 +1100
committer Anis Assi <anisassi@google.com> Thu Apr 09 13:45:40 2020 -0700
tree 3319aa3988fb14c85b2121bccbf5032fff6b9c9f
parent 90da8c8f15db2c82aece6e4085aaf9c116d481f2

pppd: Fix bounds check in EAP code

Given that we have just checked vallen <= len, it can never be the case
that vallen >= len + sizeof(rhostname).  This fixes the check so we
actually avoid overflowing the rhostname array.

Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
Signed-off-by: Paul Mackerras <paulus@ozlabs.org>
Bug: 151153886
Change-Id: Ibc29e1b5b17ddee256b1ff5f3e9909347403a791
Merged-In: Ibc29e1b5b17ddee256b1ff5f3e9909347403a791
(cherry picked from commit f9fec5c36952301e585a420f31e96d35a60d0498)

pppd/eap.c

diff --git a/pppd/eap.c b/pppd/eap.c
index 6ea6c1f..5940ebf 100644
--- a/pppd/eap.c
+++ b/pppd/eap.c
@@ -1421,7 +1421,7 @@
 		}
 
 		/* Not so likely to happen. */
-		if (vallen >= len + sizeof (rhostname)) {
+		if (len - vallen >= sizeof (rhostname)) {
 			dbglog("EAP: trimming really long peer name down");
 			BCOPY(inp + vallen, rhostname, sizeof (rhostname) - 1);
 			rhostname[sizeof (rhostname) - 1] = '\0';
@@ -1847,7 +1847,7 @@
 		}
 
 		/* Not so likely to happen. */
-		if (vallen >= len + sizeof (rhostname)) {
+		if (len - vallen >= sizeof (rhostname)) {
 			dbglog("EAP: trimming really long peer name down");
 			BCOPY(inp + vallen, rhostname, sizeof (rhostname) - 1);
 			rhostname[sizeof (rhostname) - 1] = '\0';