Skip to content

Commit f8d9940

Browse files
authored
pppd: fix memcpy overlap (#579)
memcpy() with overlapping src and dest buffers is an undefined behavior in C. In the current code, a ConfRej response is generated by copying input data in-place, where the dest address is lower than the src. This happens to work in practice because memcpy() forward-copies data, matching the behavior of memmove() in this case. However, if FORTIFY_SOURCE or Address Sanitizer is enabled, memcpy() will detect the overlap at run time and abort the program. Replace the memcpy() with memmove() to ensure a well-defined behavior. Reported-by: Filippo Carletti <filippo.carletti@gmail.com> Closes: #576 Signed-off-by: Qingfang Deng <dqfext@gmail.com>
1 parent f691c22 commit f8d9940

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

pppd/pppd-private.h

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -531,7 +531,7 @@ int parse_dotted_ip(char *, u_int32_t *);
531531
#define TIMEOUT(r, f, t) ppp_timeout((r), (f), (t), 0)
532532
#define UNTIMEOUT(r, f) ppp_untimeout((r), (f))
533533

534-
#define BCOPY(s, d, l) memcpy(d, s, l)
534+
#define BCOPY(s, d, l) memmove(d, s, l)
535535
#define BZERO(s, n) memset(s, 0, n)
536536
#define BCMP(s1, s2, l) memcmp(s1, s2, l)
537537

0 commit comments

Comments
 (0)