[SCM] lwIP - A Lightweight TCPIP stack branch, master, updated. STABLE-2_1_0_RELEASE-359-gd281d3e

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "lwIP - A Lightweight TCPIP stack".

The branch, master has been updated
       via  d281d3e9592a3ca2ad0c3b7840f8036facc02f7b (commit)
       via  2ee3cbe69c6d2805e64e7cac2a1c1706e49ffd86 (commit)
      from  5e52d1a4b1eb5d31e8f5dec557845b266b5e205a (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit d281d3e9592a3ca2ad0c3b7840f8036facc02f7b
Author: Paul Mackerras <[email protected]>
Date:   Mon Feb 10 23:33:29 2020 +0100

    PPP, EAP: ignore received EAP messages when not doing EAP
    
    This adds some basic checks to the subroutines of eap_input to check
    that we have requested or agreed to doing EAP authentication before
    doing any processing on the received packet.  The motivation is to
    make it harder for a malicious peer to disrupt the operation of pppd
    by sending unsolicited EAP packets.  Note that eap_success() already
    has a check that the EAP client state is reasonable, and does nothing
    (apart from possibly printing a debug message) if not.
    
    Signed-off-by: Paul Mackerras <[email protected]>
    Signed-off-by: Sylvain Rochet <[email protected]> (ported to lwIP PPP pcb struct)

commit 2ee3cbe69c6d2805e64e7cac2a1c1706e49ffd86
Author: Paul Mackerras <[email protected]>
Date:   Mon Feb 10 23:21:35 2020 +0100

    PPP, EAP: fix bounds check in EAP code
    
    Given that we have just checked vallen < len, it can never be the case
    that vallen >= len + sizeof(rhostname).  This fixes the check so we
    actually avoid overflowing the rhostname array.
    
    Reported-by: Ilja Van Sprundel <[email protected]>
    Signed-off-by: Paul Mackerras <[email protected]>
    Signed-off-by: Sylvain Rochet <[email protected]> (compiler warning fix about int vs uint comparisons)

-----------------------------------------------------------------------

Summary of changes:
 src/netif/ppp/eap.c | 22 ++++++++++++++++++++--
 1 file changed, 20 insertions(+), 2 deletions(-)


hooks/post-receive
-- 
lwIP - A Lightweight TCPIP stack

_______________________________________________
lwip-commits mailing list
[email protected]
https://lists.nongnu.org/mailman/listinfo/lwip-commits