mirror/lwip
1
0
Fork 0
mirror of https://github.com/lwip-tcpip/lwip.git synced 2024-11-18 20:10:53 +00:00
Code Issues Packages Projects Releases Wiki Activity

PPP: check that pbuf_coalesce succeed

Browse Source 
When pbuf_coalesce fails it does nothing and returns the previous buffer
chain. Adds checks that pbuf_coalesce succeeded, otherwise drop incoming
packet.
This commit is contained in:
Sylvain Rochet 2020-10-18 02:13:08 +02:00
parent 7c0c3879b2
commit 5bf9cebb54
3 changed files with 13 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
src/netif/ppp/ppp.c
View File

@ -930,6 +930,10 @@ void ppp_input(ppp_pcb *pcb, struct pbuf *pb) {
for (i = 0; (protp = protocols[i]) != NULL; ++i) { for (i = 0; (protp = protocols[i]) != NULL; ++i) {
if (protp->protocol == protocol) { if (protp->protocol == protocol) {
pb = pbuf_coalesce(pb, PBUF_RAW); pb = pbuf_coalesce(pb, PBUF_RAW);
if (pb->next != NULL) {
PPPDEBUG(LOG_WARNING, ("ppp_input[%d]: Dropping (pbuf_coalesce failed), len=%d\n", pcb->netif->num, pb->tot_len));
goto drop;
}
(*protp->input)(pcb, (u8_t*)pb->payload, pb->len); (*protp->input)(pcb, (u8_t*)pb->payload, pb->len);
goto out; goto out;
} }

4
src/netif/ppp/pppoe.c
View File

@ -410,6 +410,10 @@ pppoe_disc_input(struct netif *netif, struct pbuf *pb)
} }
pb = pbuf_coalesce(pb, PBUF_RAW); pb = pbuf_coalesce(pb, PBUF_RAW);
if (pb->next != NULL) {
PPPDEBUG(LOG_DEBUG, ("pppoe: pbuf_coalesce failed: %d\n", pb->tot_len));
goto done;
}
ethhdr = (struct eth_hdr *)pb->payload; ethhdr = (struct eth_hdr *)pb->payload;

5
src/netif/ppp/pppol2tp.c
View File

@ -530,6 +530,11 @@ static void pppol2tp_dispatch_control_packet(pppol2tp_pcb *l2tp, u16_t port, str
l2tp->peer_ns = ns+1; l2tp->peer_ns = ns+1;
p = pbuf_coalesce(p, PBUF_RAW); p = pbuf_coalesce(p, PBUF_RAW);
if (p->next != NULL) {
PPPDEBUG(LOG_DEBUG, ("pppol2tp: pbuf_coalesce failed: %d\n", p->tot_len));
return;
}
inp = (u8_t*)p->payload; inp = (u8_t*)p->payload;
/* Decode AVPs */ /* Decode AVPs */
while (p->len > 0) { while (p->len > 0) {