[src/trunk]: src/sys/net net/if_ppp.c: Avoid user-controlled overrun in PPPIO...

[riastradh <riastradh%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/ed308a51545a
branches:  trunk
changeset: 368352:ed308a51545a
user:      riastradh <riastradh%NetBSD.org@localhost>
date:      Wed Jul 06 08:07:23 2022 +0000

description:
net/if_ppp.c: Avoid user-controlled overrun in PPPIOCSCOMPRESS.

Reported-by: syzbot+2c7bda7dc2b6c0d4f279%syzkaller.appspotmail.com@localhost

diffstat:

 sys/net/if_ppp.c |  6 ++++--
 1 files changed, 4 insertions(+), 2 deletions(-)

diffs (27 lines):

diff -r 8f8b3be5a26e -r ed308a51545a sys/net/if_ppp.c
--- a/sys/net/if_ppp.c  Wed Jul 06 08:06:59 2022 +0000
+++ b/sys/net/if_ppp.c  Wed Jul 06 08:07:23 2022 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: if_ppp.c,v 1.168 2022/07/06 08:06:59 riastradh Exp $   */
+/*     $NetBSD: if_ppp.c,v 1.169 2022/07/06 08:07:23 riastradh Exp $   */
 /*     Id: if_ppp.c,v 1.6 1997/03/04 03:33:00 paulus Exp       */
 
 /*
@@ -102,7 +102,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: if_ppp.c,v 1.168 2022/07/06 08:06:59 riastradh Exp $");
+__KERNEL_RCSID(0, "$NetBSD: if_ppp.c,v 1.169 2022/07/06 08:07:23 riastradh Exp $");
 
 #ifdef _KERNEL_OPT
 #include "ppp.h"
@@ -597,6 +597,8 @@
                nb = odp->length;
                if (nb > sizeof(ccp_option))
                        nb = sizeof(ccp_option);
+               if (nb < 3)
+                       return EINVAL;
                if ((error = copyin(odp->ptr, ccp_option, nb)) != 0)
                        return error;
                /* preliminary check on the length byte */