D57383.id179382.diff
No OneTemporary
Actions

Size

940 B

Referenced Files

None

Subscribers

None

D57383.id179382.diff
View Options

	diff --git a/sys/netpfil/ipfilter/netinet/ip_pptp_pxy.c b/sys/netpfil/ipfilter/netinet/ip_pptp_pxy.c
	--- a/sys/netpfil/ipfilter/netinet/ip_pptp_pxy.c
	+++ b/sys/netpfil/ipfilter/netinet/ip_pptp_pxy.c
	@@ -318,7 +318,9 @@
	* it should match 1a2b3c4d. Byte order is ignored,
	* deliberately, when printing out the error.
	*/
	- len = MIN(8 - pptps->pptps_bytes, dlen);
	+ if (pptps->pptps_bytes >= 8)
	+ return (-1);
	+ len = MIN((size_t)(8 - pptps->pptps_bytes), dlen);
	COPYDATA(fin->fin_m, off, len, pptps->pptps_wptr);
	pptps->pptps_bytes += len;
	pptps->pptps_wptr += len;
	@@ -361,7 +363,9 @@
	}
	}

	- len = MIN(pptps->pptps_len - pptps->pptps_bytes, dlen);
	+ if (pptps->pptps_len <= pptps->pptps_bytes)
	+ return (-1);
	+ len = MIN((size_t)(pptps->pptps_len - pptps->pptps_bytes), dlen);
	COPYDATA(fin->fin_m, off, len, pptps->pptps_wptr);
	pptps->pptps_bytes += len;
	pptps->pptps_wptr += len;