git: 4ad6d3b4ccb3 - releng/15.0 - ppp: Fix a buffer overflow in the endpoint discriminator set command

The branch releng/15.0 has been updated by markj:

URL: https://cgit.FreeBSD.org/src/commit/?id=4ad6d3b4ccb3e22acc1e53f41aaf05b476755e4a

commit 4ad6d3b4ccb3e22acc1e53f41aaf05b476755e4a
Author:     Mark Johnston <markj@FreeBSD.org>
AuthorDate: 2026-08-24 14:46:28 +0000
Commit:     Mark Johnston <markj@FreeBSD.org>
CommitDate: 2026-08-24 21:51:22 +0000

    ppp: Fix a buffer overflow in the endpoint discriminator set command
    
    Approved by:    so
    Security:       FreeBSD-SA-26:60.ppp
    Security:       CVE-2026-58097
    Reported by:    Reo Shiseki
    MFC after:      3 days
    Sponsored by:   The FreeBSD Foundation
    Differential Revision:  https://reviews.freebsd.org/D59054
    
    (cherry picked from commit 6cb7e368daab6f166b7c8e26367ea6fee4cdd03a)
    (cherry picked from commit 55ee29bf351533644d35e82da87fd1661d879f04)
---
 usr.sbin/ppp/mp.c | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/usr.sbin/ppp/mp.c b/usr.sbin/ppp/mp.c
index f5f9dd9ddece..d4055f33056f 100644
--- a/usr.sbin/ppp/mp.c
+++ b/usr.sbin/ppp/mp.c
@@ -1020,9 +1020,14 @@ mp_SetEnddisc(struct cmdargs const *arg)
       mp->cfg.enddisc.len = 20;
     } else if (!strcasecmp(arg->argv[arg->argn], "psn")) {
       if (arg->argc > arg->argn+1) {
-        mp->cfg.enddisc.class = ENDDISC_PSN;
-        strcpy(mp->cfg.enddisc.address, arg->argv[arg->argn+1]);
-        mp->cfg.enddisc.len = strlen(mp->cfg.enddisc.address);
+        if (strlcpy(mp->cfg.enddisc.address, arg->argv[arg->argn+1],
+            sizeof(mp->cfg.enddisc.address)) >= sizeof(mp->cfg.enddisc.address)) {
+          log_Printf(LogWARN, "PSN endpoint too long\n");
+          return 7;
+        } else {
+          mp->cfg.enddisc.class = ENDDISC_PSN;
+          mp->cfg.enddisc.len = strlen(mp->cfg.enddisc.address);
+        }
       } else {
         log_Printf(LogWARN, "PSN endpoint requires additional data\n");
         return 5;