| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-Id: <1157066002.13592.3.camel@alice>
Date: Fri, 01 Sep 2006 01:13:22 +0200
From: Eric Sesterhenn <snakebyte@....de>
To: linux-kernel@...r.kernel.org
Subject: [Patch] Uninitialized variable in drivers/net/wan/syncppp.c
hi,
this was spotted by coverity (id #891), when
len is equal to 4, we dont call sppp_lcp_conf_parse_options(),
to initialize rmagic.
Signed-off-by: Eric Sesterhenn <snakebyte@....de>
--- linux-2.6.18-rc5/drivers/net/wan/syncppp.c.orig 2006-09-01 00:55:08.000000000 +0200
+++ linux-2.6.18-rc5/drivers/net/wan/syncppp.c 2006-09-01 00:55:45.000000000 +0200
@@ -505,14 +505,15 @@ static void sppp_lcp_input (struct sppp
skb->len, h);
break;
case LCP_CONF_REQ:
- if (len < 4) {
+ if (len <= 4) {
if (sp->pp_flags & PP_DEBUG)
printk (KERN_DEBUG"%s: invalid lcp configure request packet length: %d bytes\n",
dev->name, len);
break;
}
- if (len>4 && !sppp_lcp_conf_parse_options (sp, h, len, &rmagic))
+ if (!sppp_lcp_conf_parse_options (sp, h, len, &rmagic))
goto badreq;
+
if (rmagic == sp->lcp.magic) {
/* Local and remote magics equal -- loopback? */
if (sp->pp_loopcnt >= MAXALIVECNT*5) {
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists