Paul DonaldandHauke Mehrtens
1e9da9798a
memcpy() with overlapping src and dest buffers is an undefined behavior in C. In the current code, a ConfRej response is generated by copying input data in-place, where the dest address is lower than the src. This happens to work in practice because memcpy() forward-copies data, matching the behavior of memmove() in this case. However, if FORTIFY_SOURCE or Address Sanitizer is enabled, memcpy() will detect the overlap at run time and abort the program. Replace the memcpy() with memmove() to ensure a well-defined behavior. Reported-by: Filippo Carletti <filippo.carletti@gmail.com> MRU patch https://github.com/ppp-project/ppp/pull/573 Signed-off-by: Paul Donald <newtwen+github@gmail.com> Link: https://github.com/openwrt/openwrt/pull/22286 Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
38 lines
1.4 KiB
Diff
38 lines
1.4 KiB
Diff
From f8d994052e3858848ce11318085e04fe7a1cfb28 Mon Sep 17 00:00:00 2001
|
|
From: LGA1150 <9155358+LGA1150@users.noreply.github.com>
|
|
Date: Thu, 5 Mar 2026 05:41:30 +0800
|
|
Subject: [PATCH] pppd: fix memcpy overlap (#579)
|
|
|
|
memcpy() with overlapping src and dest buffers is an undefined behavior
|
|
in C. In the current code, a ConfRej response is generated by copying
|
|
input data in-place, where the dest address is lower than the src.
|
|
This happens to work in practice because memcpy() forward-copies data,
|
|
matching the behavior of memmove() in this case.
|
|
|
|
However, if FORTIFY_SOURCE or Address Sanitizer is enabled, memcpy()
|
|
will detect the overlap at run time and abort the program.
|
|
|
|
Replace the memcpy() with memmove() to ensure a well-defined behavior.
|
|
|
|
Reported-by: Filippo Carletti <filippo.carletti@gmail.com>
|
|
Closes: #576
|
|
|
|
Signed-off-by: Qingfang Deng <dqfext@gmail.com>
|
|
---
|
|
pppd/pppd-private.h | 2 +-
|
|
1 file changed, 1 insertion(+), 1 deletion(-)
|
|
|
|
diff --git a/pppd/pppd-private.h b/pppd/pppd-private.h
|
|
index 5f841824..29ea940c 100644
|
|
--- a/pppd/pppd-private.h
|
|
+++ b/pppd/pppd-private.h
|
|
@@ -525,7 +525,7 @@ int parse_dotted_ip(char *, u_int32_t *)
|
|
#define TIMEOUT(r, f, t) ppp_timeout((r), (f), (t), 0)
|
|
#define UNTIMEOUT(r, f) ppp_untimeout((r), (f))
|
|
|
|
-#define BCOPY(s, d, l) memcpy(d, s, l)
|
|
+#define BCOPY(s, d, l) memmove(d, s, l)
|
|
#define BZERO(s, n) memset(s, 0, n)
|
|
#define BCMP(s1, s2, l) memcmp(s1, s2, l)
|
|
|