From bff8517d1a3942fd4fe16d910dbdbc52634160cd Mon Sep 17 00:00:00 2001 From: Github Security Lab Date: Sun, 8 Mar 2020 13:53:38 +0100 Subject: [PATCH] `vallen` is verified to be less than `len`, therefore, it can never be the case that `vallen >= len + sizeof(rhostname)`. MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This PR fixes the check so the `rhostname` array does not overflow. Reported-by: Github Security Lab Signed-off-by: Alvaro Muñoz --- uClinux-dist/config/Kconfig | 29 ----------------------------- uClinux-dist/user/pppd/pppd/eap.c | 4 ++-- 2 files changed, 2 insertions(+), 31 deletions(-) delete mode 100644 uClinux-dist/config/Kconfig diff --git a/uClinux-dist/config/Kconfig b/uClinux-dist/config/Kconfig deleted file mode 100644 index 1f6794076..000000000 --- a/uClinux-dist/config/Kconfig +++ /dev/null @@ -1,29 +0,0 @@ -############################################################################# - -# -# Kconfig - user space configuration -# - -############################################################################# - -mainmenu "Linux Application Configuration" - -config DISTVERSION - string - default "4.0" - -source ../vendors/Kconfig - -source ../lib/Kconfig -menu "Automake Libraries" -source ../lib/Kconfig.auto -endmenu - - - -source ../user/Kconfig -menu "Automake Applications" -source ../user/Kconfig.auto -endmenu - -############################################################################# diff --git a/uClinux-dist/user/pppd/pppd/eap.c b/uClinux-dist/user/pppd/pppd/eap.c index 6203f94d0..48547e6be 100644 --- a/uClinux-dist/user/pppd/pppd/eap.c +++ b/uClinux-dist/user/pppd/pppd/eap.c @@ -1421,7 +1421,7 @@ int len; } /* Not so likely to happen. */ - if (vallen >= len + sizeof (rhostname)) { + if (len - vallen >= sizeof (rhostname)) { dbglog("EAP: trimming really long peer name down"); BCOPY(inp + vallen, rhostname, sizeof (rhostname) - 1); rhostname[sizeof (rhostname) - 1] = '\0'; @@ -1847,7 +1847,7 @@ int len; } /* Not so likely to happen. */ - if (vallen >= len + sizeof (rhostname)) { + if (len - vallen >= sizeof (rhostname)) { dbglog("EAP: trimming really long peer name down"); BCOPY(inp + vallen, rhostname, sizeof (rhostname) - 1); rhostname[sizeof (rhostname) - 1] = '\0';