git: 10dd09ca4c77 - releng/14.5 - ppp: Reject invalid endpoint discriminator options

The branch releng/14.5 has been updated by cperciva:

URL: https://cgit.FreeBSD.org/src/commit/?id=10dd09ca4c7794854339794e4a881ab21310bef3

commit 10dd09ca4c7794854339794e4a881ab21310bef3
Author:     Mark Johnston <[email protected]>
AuthorDate: 2026-07-31 13:13:26 +0000
Commit:     Colin Percival <[email protected]>
CommitDate: 2026-08-20 17:53:01 +0000

    ppp: Reject invalid endpoint discriminator options
    
    Per RFC1717 section 5.1.3, the option length must be at least three.
    Processing an undersized option would trigger a large out-of-bounds
    write.
    
    Approved by:    re (cperciva)
    PR:             271910
    Reported by:    Robert Morris
    Reported by:    Décio Brandão (0xDBJ)
    Reviewed by:    emaste
    MFC after:      1 week
    Sponsored by:   The FreeBSD Foundation
    Differential Revision:  https://reviews.freebsd.org/D58554
    
    (cherry picked from commit b9d07a4308226b683b64827e0aaed1180e0da996)
    (cherry picked from commit 30b4bdd451ad4ec2470f9a378bd62e948a85ef81)
---
 usr.sbin/ppp/lcp.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/usr.sbin/ppp/lcp.c b/usr.sbin/ppp/lcp.c
index 462f3c4281bb..7029610a1591 100644
--- a/usr.sbin/ppp/lcp.c
+++ b/usr.sbin/ppp/lcp.c
@@ -1195,6 +1195,12 @@ LcpDecodeConfig(struct fsm *fp, u_char *cp, u_char *end, int mode_type,
       break;
 
     case TY_ENDDISC:
+      if (opt->hdr.len < 3) {
+        log_Printf(LogLCP, "%s - too short\n", request);
+        fsm_rej(dec, opt);
+        lcp->my_reject |= (1 << opt->hdr.id);
+        break;
+      }
       mp = &lcp->fsm.bundle->ncp.mp;
       log_Printf(LogLCP, "%s %s\n", request,
                  mp_Enddisc(opt->data[0], opt->data + 1, opt->hdr.len - 3));