diff options
| author | YASUOKA Masahiko <yasuoka@cvs.openbsd.org> | 2010-01-27 07:27:03 +0000 |
|---|---|---|
| committer | YASUOKA Masahiko <yasuoka@cvs.openbsd.org> | 2010-01-27 07:27:03 +0000 |
| commit | fc268ae826642befd89b4cbd94448e4d6494c75c (patch) | |
| tree | d73edd294a63cdeb0c3c3ba7faba6a1e1bf59aeb /usr.sbin | |
| parent | 5352dc72322ef20069415c701f9d33341165f686 (diff) | |
Fixed 2 off-by-one problems.
(found by parfait, reported by jsg@)
Diffstat (limited to 'usr.sbin')
| -rw-r--r-- | usr.sbin/npppd/l2tp/l2tp_call.c | 4 | ||||
| -rw-r--r-- | usr.sbin/npppd/pppoe/pppoed.c | 4 |
2 files changed, 4 insertions, 4 deletions
diff --git a/usr.sbin/npppd/l2tp/l2tp_call.c b/usr.sbin/npppd/l2tp/l2tp_call.c index f98e4fe0fa3..1654681bc8d 100644 --- a/usr.sbin/npppd/l2tp/l2tp_call.c +++ b/usr.sbin/npppd/l2tp/l2tp_call.c @@ -23,7 +23,7 @@ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF * SUCH DAMAGE. */ -/* $Id: l2tp_call.c,v 1.2 2010/01/13 07:49:44 yasuoka Exp $ */ +/* $Id: l2tp_call.c,v 1.3 2010/01/27 07:27:02 yasuoka Exp $ */ /**@file * L2TP LNS のコールの実装。 */ @@ -659,7 +659,7 @@ l2tp_recv_CDN(l2tp_call *_this, u_char *pkt, int pktlen) avp->attr_value[3]; len = avp->length - 12; if (len > 0) { - len = MIN(len, sizeof(pmes)); + len = MIN(len, sizeof(pmes) - 1); memcpy(pmes, &avp->attr_value[4], len); pmes[len] = '\0'; } diff --git a/usr.sbin/npppd/pppoe/pppoed.c b/usr.sbin/npppd/pppoe/pppoed.c index fdb99fad419..35f75d1bb3b 100644 --- a/usr.sbin/npppd/pppoe/pppoed.c +++ b/usr.sbin/npppd/pppoe/pppoed.c @@ -29,7 +29,7 @@ * <dt>RFC 2516</dt> * <dd>A Method for Transmitting PPP Over Ethernet (PPPoE)</dd> * </dl> - * $Id: pppoed.c,v 1.2 2010/01/13 07:49:44 yasuoka Exp $ + * $Id: pppoed.c,v 1.3 2010/01/27 07:27:02 yasuoka Exp $ */ #include <sys/types.h> #include <sys/param.h> @@ -970,7 +970,7 @@ pppoed_recv_PADI(pppoed_listener *_this, uint8_t shost[ETHER_ADDR_LEN], if (tlv0->type == PPPOE_TAG_SERVICE_NAME) { len = tlv0->length; - if (len > sizeof(sn)) + if (len >= sizeof(sn)) goto reigai; memcpy(sn, tlv0->value, len); |