The branch releng/14.4 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=8544e4ce677f7ba3e036f8206d5890e140549e9a
commit 8544e4ce677f7ba3e036f8206d5890e140549e9a Author: Mark Johnston <[email protected]> AuthorDate: 2026-08-24 14:46:28 +0000 Commit: Mark Johnston <[email protected]> CommitDate: 2026-08-24 18:59:35 +0000 ppp: Fix a buffer overflow in the endpoint discriminator set command Approved by: so Security: FreeBSD-SA-26:60.ppp Security: CVE-2026-58097 Reported by: Reo Shiseki MFC after: 3 days Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D59054 (cherry picked from commit 6cb7e368daab6f166b7c8e26367ea6fee4cdd03a) (cherry picked from commit 55ee29bf351533644d35e82da87fd1661d879f04) --- usr.sbin/ppp/mp.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/usr.sbin/ppp/mp.c b/usr.sbin/ppp/mp.c index f5f9dd9ddece..d4055f33056f 100644 --- a/usr.sbin/ppp/mp.c +++ b/usr.sbin/ppp/mp.c @@ -1020,9 +1020,14 @@ mp_SetEnddisc(struct cmdargs const *arg) mp->cfg.enddisc.len = 20; } else if (!strcasecmp(arg->argv[arg->argn], "psn")) { if (arg->argc > arg->argn+1) { - mp->cfg.enddisc.class = ENDDISC_PSN; - strcpy(mp->cfg.enddisc.address, arg->argv[arg->argn+1]); - mp->cfg.enddisc.len = strlen(mp->cfg.enddisc.address); + if (strlcpy(mp->cfg.enddisc.address, arg->argv[arg->argn+1], + sizeof(mp->cfg.enddisc.address)) >= sizeof(mp->cfg.enddisc.address)) { + log_Printf(LogWARN, "PSN endpoint too long\n"); + return 7; + } else { + mp->cfg.enddisc.class = ENDDISC_PSN; + mp->cfg.enddisc.len = strlen(mp->cfg.enddisc.address); + } } else { log_Printf(LogWARN, "PSN endpoint requires additional data\n"); return 5;
