Fixed bug #13315 (PPP PAP authentication can result in erroneous callbacks) by copying the code from recent pppd

CHANGELOG

@@ -41,6 +41,10 @@ HISTORY
 
   ++ Bugfixes:
 
+  2010-01-11: Simon Goldschmidt
+  * pap.c: Fixed bug #13315 (PPP PAP authentication can result in
+    erroneous callbacks) by copying the code from recent pppd
+
   2010-01-10: Simon Goldschmidt
   * raw.c: Fixed bug #28506 (raw_bind should filter received packets)
 

src/netif/ppp/pap.c

@@ -452,18 +452,19 @@ upap_rauthack(upap_state *u, u_char *inp, int id, int len)
    * Parse message.
    */
   if (len < sizeof (u_char)) {
-    UPAPDEBUG((LOG_INFO, "pap_rauthack: rcvd short packet.\n"));
+    UPAPDEBUG((LOG_INFO, "pap_rauthack: ignoring missing msg-length.\n"));
-    return;
+  } else {
-  }
+    GETCHAR(msglen, inp);
-  GETCHAR(msglen, inp);
+    if (msglen > 0) {
-  len -= sizeof (u_char);
+      len -= sizeof (u_char);
-  if (len < msglen) {
+      if (len < msglen) {
-    UPAPDEBUG((LOG_INFO, "pap_rauthack: rcvd short packet.\n"));
+        UPAPDEBUG((LOG_INFO, "pap_rauthack: rcvd short packet.\n"));
-    return;
+        return;
+      }
+      msg = (char *) inp;
+      PRINTMSG(msg, msglen);
+    }
   }
-  msg = (char *) inp;
-  PRINTMSG(msg, msglen);
-
   UNTIMEOUT(upap_timeout, u);    /* Cancel timeout */
   u->us_clientstate = UPAPCS_OPEN;