[PATCH] Fix segfault in pptpctrl argument parser
Christoph Biedl <[email protected]> Fri, 8 Jul 2016 00:58:07 +0200
| Newsgroups | gmane.network.poptop |
|---|---|
| Message-ID | <[email protected]> |
Hello,
it's easily possible to trigger a segfault in pptpctrl:
# /usr/sbin/pptpctrl 0 0 1 /etc/ppp/pptpd-options 0 1
This happened when triggering a bug in pptpmanager I am currently
working on. The check for (argc < 7) isn't sufficient, my suggested
fix adds a check to any GETARG_* invocation.
Christoph
--- a/pptpctrl.c
+++ b/pptpctrl.c
@@ -92,19 +92,29 @@ static void launch_pppd(char **pppaddrs, struct in_addr *inetaddrs);
#define OUR_NB_MODE O_NDELAY
#endif
+void usage()
+{
+ fprintf(stderr, "pptpctrl: insufficient arguments, see man pptpctrl\n");
+ exit(2);
+}
+
/* read a command line argument, a flag alone */
#define GETARG_INT(X) \
+ if (arg >= argc) usage() ; \
X = atoi(argv[arg++])
/* read a command line argument, a string alone */
#define GETARG_STRING(X) \
+ if (arg >= argc) usage() ; \
X = strdup(argv[arg++])
/* read a command line argument, a presence flag followed by string */
#define GETARG_VALUE(X) \
- if(atoi(argv[arg++]) != 0) \
+ if (arg >= argc) usage() ; \
+ if(atoi(argv[arg++]) != 0) { \
+ if (arg >= argc) usage() ; \
strlcpy(X, argv[arg++], sizeof(X)); \
- else \
+ } else \
*X = '\0'
int main(int argc, char **argv)
@@ -122,10 +132,8 @@ int main(int argc, char **argv)
gargv = argv;
/* fail if argument count invalid */
- if (argc < 7) {
- fprintf(stderr, "pptpctrl: insufficient arguments, see man pptpctrl\n");
- exit(2);
- }
+ if (argc < 7)
+ usage();
/* open a connection to the syslog daemon */
openlog("pptpd", LOG_PID, PPTP_FACILITY);
------------------------------------------------------------------------------
Attend Shape: An AT&T Tech Expo July 15-16. Meet us at AT&T Park in San
Francisco, CA to explore cutting-edge tech and listen to tech luminaries
present their vision of the future. This family event has something for
everyone, including kids. Get more information and register today.
http://sdm.link/attshape