[Bug 271910] bad TY_ENDDISC option can cause ppp to write beyond end of buffer

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=271910

--- Comment #1 from commit-hook@FreeBSD.org ---
A commit in branch main references this bug:

URL:
https://cgit.FreeBSD.org/src/commit/?id=b9d07a4308226b683b64827e0aaed1180e0da996

commit b9d07a4308226b683b64827e0aaed1180e0da996
Author:     Mark Johnston <markj@FreeBSD.org>
AuthorDate: 2026-07-31 13:13:26 +0000
Commit:     Mark Johnston <markj@FreeBSD.org>
CommitDate: 2026-07-31 13:13:26 +0000

    ppp: Reject invalid endpoint discriminator options

    Per RFC1717 section 5.1.3, the option length must be at least three.
    Processing an undersized option would trigger a large out-of-bounds
    write.

    PR:             271910
    Reported by:    Robert Morris
    Reported by:    Décio Brandão (0xDBJ)
    Reviewed by:    emaste
    MFC after:      1 week
    Sponsored by:   The FreeBSD Foundation
    Differential Revision:  https://reviews.freebsd.org/D58554

 usr.sbin/ppp/lcp.c | 6 ++++++
 1 file changed, 6 insertions(+)

-- 
You are receiving this mail because:
You are the assignee for the bug.