[Bug 271910] bad TY_ENDDISC option can cause ppp to write beyond end of buffer

[email protected] Fri, 31 Jul 2026 13:30:24 +0000

Newsgroups	gmane.os.freebsd.bugs
Message-ID	<[email protected]/bugzilla/>

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=3D271910

--- Comment #1 from [email protected] ---
A commit in branch main references this bug:

URL:
https://cgit.FreeBSD.org/src/commit/?id=3Db9d07a4308226b683b64827e0aaed1180=
e0da996

commit b9d07a4308226b683b64827e0aaed1180e0da996
Author:     Mark Johnston <[email protected]>
AuthorDate: 2026-07-31 13:13:26 +0000
Commit:     Mark Johnston <[email protected]>
CommitDate: 2026-07-31 13:13:26 +0000

    ppp: Reject invalid endpoint discriminator options

    Per RFC1717 section 5.1.3, the option length must be at least three.
    Processing an undersized option would trigger a large out-of-bounds
    write.

    PR:             271910
    Reported by:    Robert Morris
    Reported by:    D=C3=A9cio Brand=C3=A3o (0xDBJ)
    Reviewed by:    emaste
    MFC after:      1 week
    Sponsored by:   The FreeBSD Foundation
    Differential Revision:  https://reviews.freebsd.org/D58554

 usr.sbin/ppp/lcp.c | 6 ++++++
 1 file changed, 6 insertions(+)

--=20
You are receiving this mail because:
You are the assignee for the bug.=