Apply by doing:
cd /usr/src
patch -p0 < 033_pppd.patch
Then rebuild and install pppd:
cd usr.sbin/pppd
make obj
make
make install
Index: usr.sbin/pppd/cbcp.c
===================================================================
RCS file: /cvs/src/usr.sbin/pppd/cbcp.c,v
retrieving revision 1.5
retrieving revision 1.5.6.1
diff -u -p -r1.5 -r1.5.6.1
--- usr.sbin/pppd/cbcp.c 13 Sep 2002 18:19:45 -0000 1.5
+++ usr.sbin/pppd/cbcp.c 5 Nov 2004 01:54:12 -0000 1.5.6.1
@@ -147,13 +147,10 @@ cbcp_input(unit, inpacket, pktlen)
GETCHAR(id, inp);
GETSHORT(len, inp);
-#if 0
- if (len > pktlen) {
+ if (len < CBCP_MINLEN || len > pktlen) {
syslog(LOG_ERR, "CBCP packet: invalid length");
return;
}
-#endif
-
len -= CBCP_MINLEN;
switch(code) {
@@ -286,12 +283,16 @@ cbcp_recvreq(us, pckt, pcktlen)
address[0] = 0;
- while (len) {
+ while (len > 1) {
syslog(LOG_DEBUG, "length: %d", len);
GETCHAR(type, pckt);
GETCHAR(opt_len, pckt);
+ if (len < opt_len)
+ break;
+ len -= opt_len;
+
if (opt_len > 2)
GETCHAR(delay, pckt);
@@ -320,7 +321,6 @@ cbcp_recvreq(us, pckt, pcktlen)
case CB_CONF_LIST:
break;
}
- len -= opt_len;
}
cbcp_resp(us);
@@ -414,10 +414,13 @@ cbcp_recvack(us, pckt, len)
int opt_len;
char address[256];
- if (len) {
+ if (len > 1) {
GETCHAR(type, pckt);
GETCHAR(opt_len, pckt);
-
+
+ if (opt_len > len)
+ return;
+
if (opt_len > 2)
GETCHAR(delay, pckt);
