git: b9d07a430822 - main - ppp: Reject invalid endpoint discriminator options

The branch main has been updated by markj:

URL: https://cgit.FreeBSD.org/src/commit/?id=b9d07a4308226b683b64827e0aaed1180e0da996

commit b9d07a4308226b683b64827e0aaed1180e0da996
Author:     Mark Johnston <markj@FreeBSD.org>
AuthorDate: 2026-07-31 13:13:26 +0000
Commit:     Mark Johnston <markj@FreeBSD.org>
CommitDate: 2026-07-31 13:13:26 +0000

    ppp: Reject invalid endpoint discriminator options
    
    Per RFC1717 section 5.1.3, the option length must be at least three.
    Processing an undersized option would trigger a large out-of-bounds
    write.
    
    PR:             271910
    Reported by:    Robert Morris
    Reported by:    Décio Brandão (0xDBJ)
    Reviewed by:    emaste
    MFC after:      1 week
    Sponsored by:   The FreeBSD Foundation
    Differential Revision:  https://reviews.freebsd.org/D58554
---
 usr.sbin/ppp/lcp.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/usr.sbin/ppp/lcp.c b/usr.sbin/ppp/lcp.c
index 462f3c4281bb..7029610a1591 100644
--- a/usr.sbin/ppp/lcp.c
+++ b/usr.sbin/ppp/lcp.c
@@ -1195,6 +1195,12 @@ LcpDecodeConfig(struct fsm *fp, u_char *cp, u_char *end, int mode_type,
       break;
 
     case TY_ENDDISC:
+      if (opt->hdr.len < 3) {
+        log_Printf(LogLCP, "%s - too short\n", request);
+        fsm_rej(dec, opt);
+        lcp->my_reject |= (1 << opt->hdr.id);
+        break;
+      }
       mp = &lcp->fsm.bundle->ncp.mp;
       log_Printf(LogLCP, "%s %s\n", request,
                  mp_Enddisc(opt->data[0], opt->data + 1, opt->hdr.len - 3));