git: 607c41d8f869 - stable/14 - ppp: Avoid overflow when formatting endpoint discriminator options

The branch stable/14 has been updated by markj:

URL: https://cgit.FreeBSD.org/src/commit/?id=607c41d8f869243db275a6b1bd6cc66bf58d0f36

commit 607c41d8f869243db275a6b1bd6cc66bf58d0f36
Author:     Mark Johnston <[email protected]>
AuthorDate: 2026-08-03 15:18:25 +0000
Commit:     Mark Johnston <[email protected]>
CommitDate: 2026-08-07 00:40:03 +0000

    ppp: Avoid overflow when formatting endpoint discriminator options
    
    Each byte of the address is represented by a pair of characters, so we
    should be multiplying len by 2 when figuring out how much buffer space
    we have.  Previously, a sufficiently large option could cause an
    overflow of the global "result" buffer.
    
    Reported by:    Joshua Rogers <[email protected]>
    Tested by:      Décio Brandão (0xDBJ)
    MFC after:      3 days
    Sponsored by:   The FreeBSD Foundation
    Differential Revision:  https://reviews.freebsd.org/D58555
    
    (cherry picked from commit e004ff15f87e6aa8f2aa13cd5600ae13457b95f1)
---
 usr.sbin/ppp/mp.c | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/usr.sbin/ppp/mp.c b/usr.sbin/ppp/mp.c
index 84ddb6e053e3..f5f9dd9ddece 100644
--- a/usr.sbin/ppp/mp.c
+++ b/usr.sbin/ppp/mp.c
@@ -931,10 +931,10 @@ mp_Enddisc(u_char c, const char *address, size_t len)
     case ENDDISC_MAGIC:
       sprintf(result, "Magic: 0x");
       header = strlen(result);
-      if (len + header + 1 > sizeof result)
-        len = sizeof result - header - 1;
+      if (2 * len + header + 1 > sizeof result)
+        len = (sizeof result - header - 1) / 2;
       for (f = 0; f < len; f++)
-        sprintf(result + header + 2 * f, "%02x", address[f]);
+        sprintf(result + header + 2 * f, "%02x", (unsigned char)address[f]);
       break;
 
     case ENDDISC_PSN:
@@ -944,10 +944,10 @@ mp_Enddisc(u_char c, const char *address, size_t len)
     default:
       sprintf(result, "%d: ", (int)c);
       header = strlen(result);
-      if (len + header + 1 > sizeof result)
-        len = sizeof result - header - 1;
+      if (2 * len + header + 1 > sizeof result)
+        len = (sizeof result - header - 1) / 2;
       for (f = 0; f < len; f++)
-        sprintf(result + header + 2 * f, "%02x", address[f]);
+        sprintf(result + header + 2 * f, "%02x", (unsigned char)address[f]);
       break;
   }
   return result;