1e9da9798a
memcpy() with overlapping src and dest buffers is an undefined behavior in C. In the current code, a ConfRej response is generated by copying input data in-place, where the dest address is lower than the src. This happens to work in practice because memcpy() forward-copies data, matching the behavior of memmove() in this case. However, if FORTIFY_SOURCE or Address Sanitizer is enabled, memcpy() will detect the overlap at run time and abort the program. Replace the memcpy() with memmove() to ensure a well-defined behavior. Reported-by: Filippo Carletti <filippo.carletti@gmail.com> MRU patch https://github.com/ppp-project/ppp/pull/573 Signed-off-by: Paul Donald <newtwen+github@gmail.com> Link: https://github.com/openwrt/openwrt/pull/22286 Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
29 lines
984 B
Diff
29 lines
984 B
Diff
From f691c224e12ee13a1b317a1838d150f1ffef14a1 Mon Sep 17 00:00:00 2001
|
|
From: Mateusz Poliwczak <mpoliwczak34@gmail.com>
|
|
Date: Wed, 11 Feb 2026 00:40:14 +0100
|
|
Subject: [PATCH] Remove MRU limit on PPPoE (#573)
|
|
|
|
Fixes #331
|
|
|
|
Signed-off-by: Mateusz Poliwczak <mpoliwczak34@gmail.com>
|
|
---
|
|
pppd/plugins/pppoe/plugin.c | 5 -----
|
|
1 file changed, 5 deletions(-)
|
|
|
|
diff --git a/pppd/plugins/pppoe/plugin.c b/pppd/plugins/pppoe/plugin.c
|
|
index b429a2fd..0f672166 100644
|
|
--- a/pppd/plugins/pppoe/plugin.c
|
|
+++ b/pppd/plugins/pppoe/plugin.c
|
|
@@ -446,11 +446,6 @@ void pppoe_check_options(void)
|
|
lcp_allowoptions[0].neg_pcompression = 0;
|
|
lcp_wantoptions[0].neg_pcompression = 0;
|
|
|
|
- if (lcp_allowoptions[0].mru > MAX_PPPOE_MTU)
|
|
- lcp_allowoptions[0].mru = MAX_PPPOE_MTU;
|
|
- if (lcp_wantoptions[0].mru > MAX_PPPOE_MTU)
|
|
- lcp_wantoptions[0].mru = MAX_PPPOE_MTU;
|
|
-
|
|
/* Save configuration */
|
|
conn->storedmtu = lcp_allowoptions[0].mru;
|
|
conn->storedmru = lcp_wantoptions[0].mru;
|