From f7a7179f0fecc8d4e0dfb40980a3f903f39c5271 Mon Sep 17 00:00:00 2001
From: brian <brian@FreeBSD.org>
Date: Tue, 16 Mar 1999 01:24:23 +0000
Subject: [PATCH] Detect pred1 packets where the length != the packet length
 Use a maximum of MAX_MRU + 2 bytes for incoming packets, not MAX_MTU + 2.
 Tidy up some diagnostics.

---
 usr.sbin/ppp/pred.c | 29 +++++++++++++++++------------
 1 file changed, 17 insertions(+), 12 deletions(-)

diff --git a/usr.sbin/ppp/pred.c b/usr.sbin/ppp/pred.c
index b910f4c93667..1919a8eeeee6 100644
--- a/usr.sbin/ppp/pred.c
+++ b/usr.sbin/ppp/pred.c
@@ -26,7 +26,7 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
- *	$Id: pred.c,v 1.22 1998/08/07 18:42:50 brian Exp $
+ *	$Id: pred.c,v 1.23 1999/03/11 01:49:15 brian Exp $
  */
 
 #include <sys/types.h>
@@ -87,17 +87,16 @@ compress(struct pred1_state *state, u_char *source, u_char *dest, int len)
 }
 
 static void
-SyncTable(struct pred1_state *state, u_char * source, u_char * dest, int len)
+SyncTable(struct pred1_state *state, u_char *source, u_char *dest, int len)
 {
   while (len--) {
-    if (state->dict[state->hash] != *source)
-      state->dict[state->hash] = *source;
-    HASH(state, *dest++ = *source++);
+    *dest++ = state->dict[state->hash] = *source;
+    HASH(state, *source++);
   }
 }
 
 static int
-decompress(struct pred1_state *state, u_char * source, u_char * dest, int len)
+decompress(struct pred1_state *state, u_char *source, u_char *dest, int len)
 {
   int i, bitmask;
   unsigned char flags, *orgdest;
@@ -220,7 +219,7 @@ Pred1Input(void *v, struct ccp *ccp, u_short *proto, struct mbuf *bp)
   u_char *bufp;
   u_short fcs;
 
-  wp = mbuf_Alloc(MAX_MTU + 2, MB_IPIN);
+  wp = mbuf_Alloc(MAX_MRU + 2, MB_IPIN);
   cp = MBUF_CTOP(bp);
   olen = mbuf_Length(bp);
   pp = bufp = MBUF_CTOP(wp);
@@ -242,6 +241,12 @@ Pred1Input(void *v, struct ccp *ccp, u_short *proto, struct mbuf *bp)
     }
     cp += olen - 4;
     pp += len1;
+  } else if (len + 4 != olen) {
+    log_Printf(LogCCP, "Pred1: Length error (got %d, not %d)\n", len + 4, olen);
+    fsm_Reopen(&ccp->fsm);
+    mbuf_Free(wp);
+    mbuf_Free(bp);
+    return NULL;
   } else {
     ccp->compin += len;
     SyncTable(state, cp, pp, len);
@@ -251,10 +256,6 @@ Pred1Input(void *v, struct ccp *ccp, u_short *proto, struct mbuf *bp)
   *pp++ = *cp++;		/* CRC */
   *pp++ = *cp++;
   fcs = hdlc_Fcs(INITFCS, bufp, wp->cnt = pp - bufp);
-  if (fcs != GOODFCS)
-    log_Printf(LogDEBUG, "Pred1Input: fcs = 0x%04x (%s), len = 0x%x,"
-	      " olen = 0x%x\n", fcs, (fcs == GOODFCS) ? "good" : "bad",
-	      len, olen);
   if (fcs == GOODFCS) {
     wp->offset += 2;		/* skip length */
     wp->cnt -= 4;		/* skip length & CRC */
@@ -271,7 +272,11 @@ Pred1Input(void *v, struct ccp *ccp, u_short *proto, struct mbuf *bp)
     mbuf_Free(bp);
     return wp;
   } else {
-    log_Printf(LogCCP, "%s: Bad CRC-16\n", ccp->fsm.link->name);
+    const char *pre = *MBUF_CTOP(bp) & 0x80 ? "" : "un";
+    log_Printf(LogDEBUG, "Pred1Input: fcs = 0x%04x (%scompressed), len = 0x%x,"
+	      " olen = 0x%x\n", fcs, pre, len, olen);
+    log_Printf(LogCCP, "%s: Bad %scompressed CRC-16\n",
+               ccp->fsm.link->name, pre);
     fsm_Reopen(&ccp->fsm);
     mbuf_Free(wp);
   }