[lwip-commits] [SCM] lwIP - A Lightweight TCPIP stack branch, master, updated. STABLE-2_1_0_RELEASE-359-gd281d3e

[Sylvain Rochet]

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "lwIP - A Lightweight TCPIP stack".

The branch, master has been updated
       via  d281d3e9592a3ca2ad0c3b7840f8036facc02f7b (commit)
       via  2ee3cbe69c6d2805e64e7cac2a1c1706e49ffd86 (commit)
      from  5e52d1a4b1eb5d31e8f5dec557845b266b5e205a (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit d281d3e9592a3ca2ad0c3b7840f8036facc02f7b
Author: Paul Mackerras <address@hidden>
Date:   Mon Feb 10 23:33:29 2020 +0100

    PPP, EAP: ignore received EAP messages when not doing EAP
    
    This adds some basic checks to the subroutines of eap_input to check
    that we have requested or agreed to doing EAP authentication before
    doing any processing on the received packet.  The motivation is to
    make it harder for a malicious peer to disrupt the operation of pppd
    by sending unsolicited EAP packets.  Note that eap_success() already
    has a check that the EAP client state is reasonable, and does nothing
    (apart from possibly printing a debug message) if not.
    
    Signed-off-by: Paul Mackerras <address@hidden>
    Signed-off-by: Sylvain Rochet <address@hidden> (ported to lwIP PPP pcb 
struct)

commit 2ee3cbe69c6d2805e64e7cac2a1c1706e49ffd86
Author: Paul Mackerras <address@hidden>
Date:   Mon Feb 10 23:21:35 2020 +0100

    PPP, EAP: fix bounds check in EAP code
    
    Given that we have just checked vallen < len, it can never be the case
    that vallen >= len + sizeof(rhostname).  This fixes the check so we
    actually avoid overflowing the rhostname array.
    
    Reported-by: Ilja Van Sprundel <address@hidden>
    Signed-off-by: Paul Mackerras <address@hidden>
    Signed-off-by: Sylvain Rochet <address@hidden> (compiler warning fix about 
int vs uint comparisons)

-----------------------------------------------------------------------

Summary of changes:
 src/netif/ppp/eap.c | 22 ++++++++++++++++++++--
 1 file changed, 20 insertions(+), 2 deletions(-)


hooks/post-receive
-- 
lwIP - A Lightweight TCPIP stack