ppp: Don't fetch a non-existent variadic argument

Only fetch the optional mode argument to ID0open to pass to open(2) if
O_CREAT is present in the flags argument.  It is UB to fetch an
argument that doesn't exist.  On CHERI this UB results in a fault.

Reviewed by:	brooks
Obtained from:	CheriBSD
Sponsored by:	AFRL, DARPA
Differential Revision:	https://reviews.freebsd.org/D57137

This commit is contained in:

John Baldwin

2026-06-10 09:44:10 -04:00

parent 0492dbe921

commit b5a8b933d4

1 changed files with 4 additions and 1 deletions

									
										usr.sbin/ppp/id.c
									
		+4
		-1
	
												View File
												
				@@ -145,7 +145,10 @@ ID0open(const char *path, int flags, ...)

				  va_start(ap, flags);

				  ID0set0();

				  ret = open(path, flags, va_arg(ap, int));

				  if (flags & O_CREAT)

					  ret = open(path, flags, va_arg(ap, int));

				  else

					  ret = open(path, flags);

				  log_Printf(LogID0, "%d = open(\"%s\", %d)\n", ret, path, flags);

				  ID0setuser();

				  va_end(ap);