+
−/*
+
−+-----------------------------------------------------------------------------
+
−|  Project :
+
−|  Modul   :
+
−+-----------------------------------------------------------------------------
+
−|  Copyright 2002 Texas Instruments Berlin, AG
+
−|                 All rights reserved.
+
−|
+
−|                 This file is confidential and a trade secret of Texas
+
−|                 Instruments Berlin, AG
+
−|                 The receipt of or possession of this file does not convey
+
−|                 any rights to reproduce or disclose its contents or to
+
−|                 manufacture, use, or sell anything it may describe, in
+
−|                 whole, or in part, without the specific written consent of
+
−|                 Texas Instruments Berlin, AG.
+
−+-----------------------------------------------------------------------------
+
−|  Purpose :  This modul is part of the entity PPP and implements all
+
−|             procedures and functions as described in the
+
−|             SDL-documentation (NCP-statemachine)
+
−+-----------------------------------------------------------------------------
+
−*/
+
−
+
−#define ENTITY_PPP
+
−
+
−/*==== INCLUDES =============================================================*/
+
−
+
−#include "typedefs.h"   /* to get Condat data types */
+
−#include "vsi.h"        /* to get a lot of macros */
+
−#include "macdef.h"     /* to get a lot of macros */
+
−#include "custom.h"     /* to get a lot of macros */
+
−#include "gsm.h"        /* to get a lot of macros */
+
−#include "prim.h"       /* to get the definitions of used SAP and directions */
+
−#include "dti.h"        /* to get the DTILIB definitions */
+
−#include "ppp.h"        /* to get the global entity definitions */
+
−
+
−#include <string.h>     /* to get memcpy */
+
−#include "ppp_arbf.h"   /* to get function interface from arb */
+
−
+
−/*==== CONST ================================================================*/
+
−
+
−#define TYPE_HC                   2
+
−#define TYPE_IP                   3
+
−#define TYPE_PDNS                 129
+
−#define TYPE_SDNS                 131
+
−#define TYPE_ADJUST               125
+
−
+
−#define MASK_TYPE_HC              TYPE_HC
+
−#define MASK_TYPE_IP              TYPE_IP
+
−#define MASK_TYPE_PDNS            (TYPE_PDNS - TYPE_ADJUST)
+
−#define MASK_TYPE_SDNS            (TYPE_SDNS - TYPE_ADJUST)
+
−
+
−#define LENGTH_HC_VJ              6
+
−#define LENGTH_HC_MAX             LENGTH_HC_VJ
+
−#define LENGTH_IP                 6
+
−#define LENGTH_PDNS               6
+
−#define LENGTH_SDNS               6
+
−
+
−#define NCP_CONF_REQ_LENGTH_MAX   (4 +              \
+
−                                   LENGTH_HC_MAX +  \
+
−                                   LENGTH_IP +      \
+
−                                   LENGTH_PDNS +    \
+
−                                   LENGTH_SDNS)
+
−#define NCP_TERM_REQ_LENGTH       6
+
−
+
−#define PPP_CSID_YES              1
+
−
+
−/*==== LOCAL VARS ===========================================================*/
+
−
+
−/*==== PRIVATE FUNCTIONS ====================================================*/
+
−
+
−/*==== PUBLIC FUNCTIONS =====================================================*/
+
−
+
−
+
−
+
−/*
+
−+------------------------------------------------------------------------------
+
−| Function    : ncp_init
+
−+------------------------------------------------------------------------------
+
−| Description : The function ncp_init() initialize Network Control Protocol
+
−|
+
−| Parameters  : no parameters
+
−|
+
−+------------------------------------------------------------------------------
+
−*/
+
−GLOBAL void ncp_init ()
+
−{
+
−  TRACE_FUNCTION( "ncp_init" );
+
−  /*
+
−   * initialize values
+
−   */
+
−  ppp_data->ncp.req_hc      = PPP_HC_DEFAULT;
+
−  ppp_data->ncp.req_msid    = PPP_MSID_DEFAULT;
+
−  ppp_data->ncp.req_ip      = PPP_IP_DEFAULT;
+
−  ppp_data->ncp.req_pdns    = PPP_PDNS_DEFAULT;
+
−  ppp_data->ncp.req_sdns    = PPP_SDNS_DEFAULT;
+
−  ppp_data->ncp.req_gateway = PPP_GATEWAY_DEFAULT;
+
−
+
−  ppp_data->ncp.s_hc      = PPP_HC_DEFAULT;
+
−  ppp_data->ncp.s_msid    = PPP_MSID_DEFAULT;
+
−  ppp_data->ncp.r_hc      = PPP_HC_DEFAULT;
+
−  ppp_data->ncp.r_msid    = PPP_MSID_DEFAULT;
+
−  ppp_data->ncp.n_ip      = PPP_IP_DEFAULT;
+
−  ppp_data->ncp.n_pdns    = PPP_PDNS_DEFAULT;
+
−  ppp_data->ncp.n_sdns    = PPP_SDNS_DEFAULT;
+
−  ppp_data->ncp.n_gateway = PPP_GATEWAY_DEFAULT;
+
−
+
−  ppp_data->ncp.s_rejected = 0;
+
−
+
−  ppp_data->ncp.nscri = 0;
+
−  ppp_data->ncp.nstri = 0;
+
−  ppp_data->ncp.nscji = 0;
+
−
+
−  ppp_data->ncp.scr=FALSE;
+
−  ppp_data->ncp.str=FALSE;
+
−  ppp_data->ncp.rcr=FALSE;
+
−
+
−  INIT_STATE( PPP_SERVICE_NCP , NCP_STATE );
+
−} /* ncp_init() */
+
−
+
−
+
−
+
−/*
+
−+------------------------------------------------------------------------------
+
−| Function    : ncp_get_values
+
−+------------------------------------------------------------------------------
+
−| Description : The function ncp_get_values() returns negotiated values
+
−|
+
−| Parameters  : ptr_hc   - returns IP Header Compression
+
−|               ptr_msid - returns max slot identifier
+
−|               ptr_ip   - returns IP address
+
−|               ptr_pdns - returns primary DNS server address
+
−|               ptr_pdns - returns secondary DNS server address
+
−|
+
−+------------------------------------------------------------------------------
+
−*/
+
−GLOBAL void ncp_get_values (UBYTE* ptr_hc, UBYTE* ptr_msid, ULONG* ptr_ip,
+
−                            ULONG* ptr_pdns, ULONG* ptr_sdns)
+
−{
+
−  TRACE_FUNCTION( "ncp_get_values" );
+
−
+
−  *ptr_hc   = ppp_data->ncp.r_hc;
+
−  if(ppp_data->ncp.r_msid < ppp_data->ncp.s_msid)
+
−    *ptr_msid = ppp_data->ncp.r_msid;
+
−  else
+
−    *ptr_msid = ppp_data->ncp.s_msid;
+
−  *ptr_ip   = ppp_data->ncp.n_ip;
+
−  *ptr_pdns = ppp_data->ncp.n_pdns;
+
−  *ptr_sdns = ppp_data->ncp.n_sdns;
+
−
+
−} /* ncp_get_values() */
+
−
+
−
+
−
+
−/*
+
−+------------------------------------------------------------------------------
+
−| Function    : ncp_get_scr
+
−+------------------------------------------------------------------------------
+
−| Description : The function ncp_get_scr() creates a NCP Configure Request
+
−|               packet.
+
−|
+
−| Parameters  : ptr_packet - returns the Configure Request packet
+
−|                            THE MEMORY FOR THE PACKET WILL ALLOCATED BY
+
−|                            THIS FUNCTION
+
−|
+
−+------------------------------------------------------------------------------
+
−*/
+
−GLOBAL void ncp_get_scr (T_desc2** ptr_packet)
+
−{
+
−  T_desc2* ret_desc;
+
−  USHORT   len_pos;
+
−  USHORT   pos;
+
−
+
−  TRACE_FUNCTION( "ncp_get_scr" );
+
−
+
−  /*
+
−   * Allocate the necessary size for the data descriptor. The size is
+
−   * calculated as follows:
+
−   * - take the size of a descriptor structure
+
−   * - subtract one because of the array buffer[1] to get the size of
+
−   *   descriptor control information
+
−   * - add number of octets of descriptor data
+
−   */
+
−  MALLOC (ret_desc, (USHORT)(sizeof(T_desc2) - 1 + NCP_CONF_REQ_LENGTH_MAX));
+
−  /*
+
−   * fill the packet
+
−   */
+
−  ret_desc->next=(ULONG)NULL;
+
−  pos=0;
+
−    /*
+
−     * Code field
+
−     */
+
−  ret_desc->buffer[pos]=CODE_CONF_REQ;
+
−  pos++;
+
−    /*
+
−     * Identifier field
+
−     */
+
−  ret_desc->buffer[pos]=ppp_data->ncp.nscri;/*lint !e415 access of out-of-bounds pointer */
+
−  pos++;
+
−    /*
+
−     * Length field (store the position)
+
−     */
+
−  len_pos=pos;
+
−  pos++;
+
−  pos++;
+
−      /*
+
−       * Header Compression Protocol (only server mode)
+
−       */
+
−  if(((ppp_data->ncp.s_rejected & (1UL << MASK_TYPE_HC)) EQ 0) &&
+
−     (ppp_data->ncp.s_hc NEQ PPP_HC_DEFAULT))
+
−  {
+
−    if(ppp_data->ncp.s_hc EQ PPP_HC_VJ)
+
−    {
+
−      ret_desc->buffer[pos] = TYPE_HC;/*lint !e415 !e416 access of out-of-bounds pointer */
+
−      pos++;
+
−      ret_desc->buffer[pos] = LENGTH_HC_VJ;/*lint !e415 !e416 access of out-of-bounds pointer */
+
−      pos++;
+
−      ret_desc->buffer[pos] = PROTOCOL_VJ_MSB;/*lint !e415 !e416 access of out-of-bounds pointer */
+
−      pos++;
+
−      ret_desc->buffer[pos] = PROTOCOL_VJ_LSB;/*lint !e415 !e416 access of out-of-bounds pointer */
+
−      pos++;
+
−      ret_desc->buffer[pos] = ppp_data->ncp.s_msid;/*lint !e415 !e416 access of out-of-bounds pointer */
+
−      pos++;
+
−      ret_desc->buffer[pos] = PPP_CSID_YES;/*lint !e415 !e416 access of out-of-bounds pointer */
+
−      pos++;
+
−    }
+
−    /*
+
−     * include additional header compression protocols
+
−     */
+
−  }
+
−      /*
+
−       * IP Address (only client mode)
+
−       */
+
−  if(((ppp_data->ncp.s_rejected & (1UL << MASK_TYPE_IP)) EQ 0) &&
+
−     (ppp_data->mode EQ PPP_CLIENT))
+
−  {
+
−    ret_desc->buffer[pos]=TYPE_IP;/*lint !e662 !e661 possible creation and access of out-of-bounds pointer*/
+
−    pos++;
+
−    ret_desc->buffer[pos]=LENGTH_IP;/*lint !e662 !e661 possible creation and access of out-of-bounds pointer*/
+
−    pos++;
+
−    ret_desc->buffer[pos]=(UBYTE)(ppp_data->ncp.n_ip >> 24);/*lint !e662 !e661 possible creation and access of out-of-bounds pointer*/
+
−    pos++;
+
−    ret_desc->buffer[pos]=(UBYTE)((ppp_data->ncp.n_ip >> 16) & 0x000000ff);/*lint !e662 !e661 possible creation and access of out-of-bounds pointer*/
+
−    pos++;
+
−    ret_desc->buffer[pos]=(UBYTE)((ppp_data->ncp.n_ip >>  8) & 0x000000ff);/*lint !e662 !e661 possible creation and access of out-of-bounds pointer*/
+
−    pos++;
+
−    ret_desc->buffer[pos]=(UBYTE)(ppp_data->ncp.n_ip & 0x000000ff);/*lint !e662 !e661 possible creation and access of out-of-bounds pointer*/
+
−    pos++;
+
−  }
+
−      /*
+
−       * Gateway Address (only server mode)
+
−       */
+
−  if(((ppp_data->ncp.s_rejected & (1UL << MASK_TYPE_IP)) EQ 0) &&
+
−     (ppp_data->mode EQ PPP_SERVER)                            &&
+
−     (ppp_data->ncp.n_gateway NEQ PPP_GATEWAY_DEFAULT))
+
−  {
+
−    ret_desc->buffer[pos]=TYPE_IP;/*lint !e662 !e661 possible creation and access of out-of-bounds pointer*/
+
−    pos++;
+
−    ret_desc->buffer[pos]=LENGTH_IP;/*lint !e662 !e661 possible creation and access of out-of-bounds pointer*/
+
−    pos++;
+
−    ret_desc->buffer[pos]=(UBYTE)(ppp_data->ncp.n_gateway >> 24);/*lint !e662 !e661 possible creation and access of out-of-bounds pointer*/
+
−    pos++;
+
−    ret_desc->buffer[pos]=(UBYTE)((ppp_data->ncp.n_gateway >> 16) & 0x000000ff);/*lint !e662 !e661 possible creation and access of out-of-bounds pointer*/
+
−    pos++;
+
−    ret_desc->buffer[pos]=(UBYTE)((ppp_data->ncp.n_gateway >>  8) & 0x000000ff);/*lint !e662 !e661 possible creation and access of out-of-bounds pointer*/
+
−    pos++;
+
−    ret_desc->buffer[pos]=(UBYTE)(ppp_data->ncp.n_gateway & 0x000000ff);/*lint !e662 !e661 possible creation and access of out-of-bounds pointer*/
+
−    pos++;
+
−  }
+
−      /*
+
−       * Primary DNS address (only client mode)
+
−       */
+
−  if(((ppp_data->ncp.s_rejected & (1UL << MASK_TYPE_PDNS)) EQ 0) &&
+
−     (ppp_data->mode EQ PPP_CLIENT))
+
−  {
+
−    ret_desc->buffer[pos]=TYPE_PDNS;/*lint !e662 !e661 possible creation and access of out-of-bounds pointer*/
+
−    pos++;
+
−    ret_desc->buffer[pos]=LENGTH_PDNS;/*lint !e662 !e661 possible creation and access of out-of-bounds pointer*/
+
−    pos++;
+
−    ret_desc->buffer[pos]=(UBYTE)(ppp_data->ncp.n_pdns >> 24);/*lint !e662 !e661 possible creation and access of out-of-bounds pointer*/
+
−    pos++;
+
−    ret_desc->buffer[pos]=(UBYTE)((ppp_data->ncp.n_pdns >> 16) & 0x000000ff);/*lint !e662 !e661 possible creation and access of out-of-bounds pointer*/
+
−    pos++;
+
−    ret_desc->buffer[pos]=(UBYTE)((ppp_data->ncp.n_pdns >>  8) & 0x000000ff);/*lint !e662 !e661 possible creation and access of out-of-bounds pointer*/
+
−    pos++;
+
−    ret_desc->buffer[pos]=(UBYTE)(ppp_data->ncp.n_pdns & 0x000000ff);/*lint !e662 !e661 possible creation and access of out-of-bounds pointer*/
+
−    pos++;
+
−  }
+
−      /*
+
−       * Secondary DNS address (only client mode)
+
−       */
+
−  if(((ppp_data->ncp.s_rejected & (1UL << MASK_TYPE_SDNS)) EQ 0) &&
+
−     (ppp_data->mode EQ PPP_CLIENT))
+
−  {
+
−    ret_desc->buffer[pos]=TYPE_SDNS;/*lint !e662 !e661 possible creation and access of out-of-bounds pointer*/
+
−    pos++;
+
−    ret_desc->buffer[pos]=LENGTH_SDNS;/*lint !e662 !e661 possible creation and access of out-of-bounds pointer*/
+
−    pos++;
+
−    ret_desc->buffer[pos]=(UBYTE)(ppp_data->ncp.n_sdns >> 24);/*lint !e662 !e661 possible creation and access of out-of-bounds pointer*/
+
−    pos++;
+
−    ret_desc->buffer[pos]=(UBYTE)((ppp_data->ncp.n_sdns >> 16) & 0x000000ff);/*lint !e662 !e661 possible creation and access of out-of-bounds pointer*/
+
−    pos++;
+
−    ret_desc->buffer[pos]=(UBYTE)((ppp_data->ncp.n_sdns >>  8) & 0x000000ff);/*lint !e662 !e661 possible creation and access of out-of-bounds pointer*/
+
−    pos++;
+
−    ret_desc->buffer[pos]=(UBYTE)(ppp_data->ncp.n_sdns & 0x000000ff);/*lint !e662 !e661 possible creation and access of out-of-bounds pointer*/
+
−    pos++;
+
−  }
+
−  /*
+
−   * insert packet length
+
−   */
+
−  ret_desc->len=pos;
+
−  ret_desc->buffer[len_pos]=(UBYTE)(pos >> 8);/*lint !e415 !e416 creation and access of out-of-bounds pointer */
+
−  len_pos++;
+
−  ret_desc->buffer[len_pos]=(UBYTE)(pos & 0x00ff);/*lint !e415 !e416 creation and access of out-of-bounds pointer */
+
−
+
−  /*
+
−   * return the created packet
+
−   */
+
−  ppp_data->ncp.scr=TRUE;
+
−  *ptr_packet=ret_desc;
+
−
+
−} /* ncp_get_scr() */
+
−
+
−
+
−
+
−/*
+
−+------------------------------------------------------------------------------
+
−| Function    : ncp_get_str
+
−+------------------------------------------------------------------------------
+
−| Description : The function ncp_get_str() creates a NCP Terminate Request
+
−|               packet.
+
−|
+
−| Parameters  : ptr_packet - returns the Terminate Request packet
+
−|                            THE MEMORY FOR THE PACKET WILL ALLOCATED BY
+
−|                            THIS FUNCTION
+
−|
+
−+------------------------------------------------------------------------------
+
−*/
+
−GLOBAL void ncp_get_str (T_desc2** ptr_packet)
+
−{
+
−  T_desc2* ret_desc;
+
−  USHORT   pos;
+
−
+
−  TRACE_FUNCTION( "ncp_get_str" );
+
−
+
−  /*
+
−   * Allocate the necessary size for the data descriptor. The size is
+
−   * calculated as follows:
+
−   * - take the size of a descriptor structure
+
−   * - subtract one because of the array buffer[1] to get the size of
+
−   *   descriptor control information
+
−   * - add number of octets of descriptor data
+
−   */
+
−  MALLOC (ret_desc, (USHORT)(sizeof(T_desc2) - 1 + NCP_TERM_REQ_LENGTH));
+
−  /*
+
−   * fill the packet
+
−   */
+
−  ret_desc->next = (ULONG)NULL;
+
−  ret_desc->len  = NCP_TERM_REQ_LENGTH;
+
−  pos            = 0;
+
−    /*
+
−     * Code field
+
−     */
+
−  ret_desc->buffer[pos] = CODE_TERM_REQ;
+
−  pos++;
+
−    /*
+
−     * Identifier field
+
−     */
+
−  ret_desc->buffer[pos] = ppp_data->ncp.nstri;/*lint !e415 access of out-of-bounds pointer */
+
−  pos++;
+
−    /*
+
−     * Length field
+
−     */
+
−  ret_desc->buffer[pos] = 0;/*lint !e415 !e416 creation and access of out-of-bounds pointer */
+
−  pos++;
+
−  ret_desc->buffer[pos] = NCP_TERM_REQ_LENGTH;/*lint !e415 !e416 creation and access of out-of-bounds pointer */
+
−  pos++;
+
−    /*
+
−     * Data field contains the error code
+
−     */
+
−  ret_desc->buffer[pos] = (U8)((ppp_data->ppp_cause >> 8) & 0x00ff);/*lint !e415 !e416 creation and access of out-of-bounds pointer */
+
−  pos++;
+
−  ret_desc->buffer[pos] = (U8)((ppp_data->ppp_cause)      & 0x00ff);/*lint !e415 !e416 creation and access of out-of-bounds pointer */
+
−  pos++;
+
−
+
−  /*
+
−   * return the created packet
+
−   */
+
−  ppp_data->ncp.str = TRUE;
+
−  *ptr_packet       = ret_desc;
+
−} /* ncp_get_str() */
+
−
+
−
+
−
+
−/*
+
−+------------------------------------------------------------------------------
+
−| Function    : ncp_analyze_first_ipcp
+
−+------------------------------------------------------------------------------
+
−| Description : The function ncp_analyze_first_ipcp() determine whether the
+
−|               given packet is a Configure Request packet. If so the function
+
−|               analyzes the packet, sets some values in the data structure and
+
−|               returns the values for header comression.
+
−|
+
−| Parameters  : packet     - received packet
+
−|               ptr_result - returns the result of the analysis
+
−|               ptr_hc     - returns requested header compression
+
−|               ptr_msid   - returns requested max slot identifier
+
−|
+
−+------------------------------------------------------------------------------
+
−*/
+
−GLOBAL void ncp_analyze_first_ipcp(T_desc2* packet,
+
−                                   UBYTE*   ptr_result,
+
−                                   UBYTE*   ptr_hc,
+
−                                   UBYTE*   ptr_msid)
+
−{
+
−  USHORT  packet_len;
+
−  UBYTE   type_len;
+
−  USHORT  pos;
+
−  USHORT  analyzed;
+
−  USHORT  protocol_hc;
+
−  ULONG   ip;
+
−  ULONG   pdns;
+
−  ULONG   sdns;
+
−
+
−  TRACE_FUNCTION( "ncp_analyze_first_ipcp" );
+
−
+
−  /*
+
−   * check whether it is a Configure Request packet and
+
−   * for correct length field
+
−   */
+
−  packet_len = packet->buffer[2];/*lint !e415 !e416 creation and access of out-of-bounds pointer */
+
−  packet_len <<= 8;
+
−  packet_len+= packet->buffer[3];/*lint !e415 !e416 creation and access of out-of-bounds pointer */
+
−  if((packet->buffer[0] NEQ CODE_CONF_REQ) ||
+
−     (packet_len > packet->len) ||
+
−     (packet_len < 4))
+
−  {
+
−    *ptr_result = FALSE;
+
−    return;
+
−  }
+
−  /*
+
−   * check consistence of length of packet and length of configuration options
+
−   */
+
−  pos=5;
+
−  while(pos < packet_len)
+
−  {
+
−    if(packet->buffer[pos] < 2)/*lint !e662 !e661 possible creation and access of out-of-bounds pointer*/
+
−    {
+
−      *ptr_result = FALSE;
+
−      return;
+
−    }
+
−    pos+= packet->buffer[pos];/*lint !e662 !e661 possible creation and access of out-of-bounds pointer*/
+
−  }
+
−  if((pos - 1) NEQ packet_len)
+
−  {
+
−    *ptr_result = FALSE;
+
−    return;
+
−  }
+
−  /*
+
−   * analyze configuration options
+
−   */
+
−  ppp_data->ncp.r_hc   = PPP_HC_DEFAULT;
+
−  ppp_data->ncp.r_msid = PPP_MSID_DEFAULT;
+
−  ppp_data->ncp.n_ip   = PPP_IP_DEFAULT;
+
−  ppp_data->ncp.n_pdns = PPP_PDNS_DEFAULT;
+
−  ppp_data->ncp.n_sdns = PPP_SDNS_DEFAULT;
+
−  pos=4;
+
−    /*
+
−     * analyzed is a bit field and marks all already analyzed
+
−     * configuration options in order to reject all configuration options
+
−     * which are listed more than once
+
−     */
+
−  analyzed=0;
+
−  while(pos < packet_len)
+
−  {
+
−    type_len=packet->buffer[pos + 1];/*lint !e662 !e661 possible creation and access of out-of-bounds pointer*/
+
−    switch(packet->buffer[pos])/*lint !e662 !e661 possible creation and access of out-of-bounds pointer*/
+
−    {
+
−      /*
+
−       * yet supported configuration options
+
−       */
+
−      case TYPE_HC: /* Header Compression */
+
−        protocol_hc = packet->buffer[pos + 2];/*lint !e662 !e661 possible creation and access of out-of-bounds pointer*/
+
−        protocol_hc <<= 8;
+
−        protocol_hc+= packet->buffer[pos + 3];/*lint !e662 !e661 possible creation and access of out-of-bounds pointer*/
+
−        if((analyzed & (1UL << MASK_TYPE_HC)) EQ 0)
+
−        {
+
−          analyzed|= (1UL << MASK_TYPE_HC);
+
−          /*
+
−           * max slot identifier should be between 3 and 254
+
−           * comp slot identifier may be compressed
+
−           */
+
−          if((protocol_hc EQ DTI_PID_CTCP) &&
+
−             (packet->buffer[pos + 4] >= 3) &&
+
−             (packet->buffer[pos + 5] EQ PPP_CSID_YES))/*lint !e662 !e661 possible creation and access of out-of-bounds pointer*/
+
−          {
+
−            ppp_data->ncp.r_hc   = PPP_HC_VJ;
+
−            ppp_data->ncp.r_msid = packet->buffer[pos + 4];/*lint !e662 !e661 possible creation and access of out-of-bounds pointer*/
+
−            if(ppp_data->ncp.r_msid > 254)
+
−              ppp_data->ncp.r_msid = 254;
+
−          }
+
−        }
+
−        break;
+
−      case TYPE_IP:
+
−        ip = packet->buffer[pos + 2];/*lint !e662 !e661 possible creation and access of out-of-bounds pointer*/
+
−        ip = (ip << 8);
+
−        ip+= packet->buffer[pos + 3];/*lint !e662 !e661 possible creation and access of out-of-bounds pointer*/
+
−        ip = (ip << 8);
+
−        ip+= packet->buffer[pos + 4];/*lint !e662 !e661 possible creation and access of out-of-bounds pointer*/
+
−        ip = (ip << 8);
+
−        ip+= packet->buffer[pos + 5];/*lint !e662 !e661 possible creation and access of out-of-bounds pointer*/
+
−        if((analyzed & (1UL << MASK_TYPE_IP)) EQ 0)
+
−        {
+
−          analyzed|=(1UL << MASK_TYPE_IP);
+
−          ppp_data->ncp.n_ip = ip;
+
−        }
+
−        break;
+
−      case TYPE_PDNS:
+
−        pdns = packet->buffer[pos + 2];/*lint !e662 !e661 possible creation and access of out-of-bounds pointer*/
+
−        pdns = (pdns << 8);
+
−        pdns+= packet->buffer[pos + 3];/*lint !e662 !e661 possible creation and access of out-of-bounds pointer*/
+
−        pdns = (pdns << 8);
+
−        pdns+= packet->buffer[pos + 4];/*lint !e662 !e661 possible creation and access of out-of-bounds pointer*/
+
−        pdns = (pdns << 8);
+
−        pdns+= packet->buffer[pos + 5];/*lint !e662 !e661 possible creation and access of out-of-bounds pointer*/
+
−        if((analyzed & (1UL << MASK_TYPE_PDNS)) EQ 0)
+
−        {
+
−          analyzed|=(1UL << MASK_TYPE_PDNS);
+
−          ppp_data->ncp.n_pdns = pdns;
+
−        }
+
−        break;
+
−      case TYPE_SDNS:
+
−        sdns = packet->buffer[pos + 2];/*lint !e662 !e661 possible creation and access of out-of-bounds pointer*/
+
−        sdns = (sdns << 8);
+
−        sdns+= packet->buffer[pos + 3];/*lint !e662 !e661 possible creation and access of out-of-bounds pointer*/
+
−        sdns = (sdns << 8);
+
−        sdns+= packet->buffer[pos + 4];/*lint !e662 !e661 possible creation and access of out-of-bounds pointer*/
+
−        sdns = (sdns << 8);
+
−        sdns+= packet->buffer[pos + 5];/*lint !e662 !e661 possible creation and access of out-of-bounds pointer*/
+
−        if((analyzed & (1UL << MASK_TYPE_SDNS)) EQ 0)
+
−        {
+
−          analyzed|=(1UL << MASK_TYPE_SDNS);
+
−          ppp_data->ncp.n_sdns = sdns;
+
−        }
+
−        break;
+
−      default:
+
−        /*
+
−         * not supported configuration options are not analysed
+
−         */
+
−        break;
+
−    }
+
−    pos+= type_len;
+
−  }
+
−  /*
+
−   * all configuration options analyzed
+
−   */
+
−  *ptr_hc     = ppp_data->ncp.r_hc;
+
−  *ptr_msid   = ppp_data->ncp.r_msid;
+
−  *ptr_result = TRUE;
+
−} /* ncp_analyze_first_ipcp() */
+
−
+
−
+
−
+
−/*
+
−+------------------------------------------------------------------------------
+
−| Function    : ncp_fill_out_packet
+
−+------------------------------------------------------------------------------
+
−| Description : The function ncp_fill_out_packet() puts a IPCP packet into
+
−|               the protocol configuration list
+
−|
+
−| Parameters  : pco_buf - pco list buffer
+
−|               ptr_pos - position where to write the IPCP packet, this value
+
−|                         must get back to the calling funtion
+
−|
+
−+------------------------------------------------------------------------------
+
−*/
+
−GLOBAL void ncp_fill_out_packet (UBYTE pco_buf[], USHORT* ptr_pos)
+
−{
+
−  USHORT  pos;
+
−  USHORT  len_pos1, len_pos2;
+
−
+
−  TRACE_FUNCTION( "ncp_fill_out_packet" );
+
−
+
−  if((ppp_data->pco_mask & PPP_PCO_MASK_IPCP_HC)   ||
+
−     (ppp_data->pco_mask & PPP_PCO_MASK_IPCP_IP)   ||
+
−     (ppp_data->pco_mask & PPP_PCO_MASK_IPCP_PDNS) ||
+
−     (ppp_data->pco_mask & PPP_PCO_MASK_IPCP_SDNS))
+
−  {
+
−    pos=*ptr_pos;
+
−    /*
+
−     * create the Configure-Request packet
+
−     */
+
−      /*
+
−       * Protocol ID
+
−       */
+
−    pco_buf[pos] = PROTOCOL_IPCP_MSB;
+
−    pos++;
+
−    pco_buf[pos] = PROTOCOL_IPCP_LSB;
+
−    pos++;
+
−      /*
+
−       * Length of Protocol contents (store the position)
+
−       */
+
−    len_pos1 = pos;
+
−    pos++;
+
−        /*
+
−         * Code field
+
−         */
+
−    pco_buf[pos] = CODE_CONF_REQ;
+
−    pos++;
+
−        /*
+
−         * Identifier field (some value)
+
−         */
+
−    pco_buf[pos] = 1;
+
−    pos++;
+
−        /*
+
−         * Length field (store the position)
+
−         */
+
−    len_pos2 = pos;
+
−    pos++;
+
−    pos++;
+
−
+
−    if(ppp_data->pco_mask & PPP_PCO_MASK_IPCP_HC)
+
−    {
+
−            /*
+
−             * Header Compression
+
−             */
+
−      if(ppp_data->ncp.r_hc EQ PPP_HC_VJ)
+
−      {
+
−        pco_buf[pos] = TYPE_HC;
+
−        pos++;
+
−        pco_buf[pos] = LENGTH_HC_VJ;
+
−        pos++;
+
−        pco_buf[pos] = PROTOCOL_VJ_MSB;
+
−        pos++;
+
−        pco_buf[pos] = PROTOCOL_VJ_LSB;
+
−        pos++;
+
−        pco_buf[pos] = ppp_data->ncp.r_msid;
+
−        pos++;
+
−        pco_buf[pos] = PPP_CSID_YES;
+
−        pos++;
+
−      }
+
−    }
+
−
+
−    if(ppp_data->pco_mask & PPP_PCO_MASK_IPCP_IP)
+
−    {
+
−            /*
+
−             * IP Address
+
−             */
+
−      pco_buf[pos] = TYPE_IP;
+
−      pos++;
+
−      pco_buf[pos] = LENGTH_IP;
+
−      pos++;
+
−      pco_buf[pos] = (UBYTE)(ppp_data->ncp.n_ip >> 24);
+
−      pos++;
+
−      pco_buf[pos] = (UBYTE)((ppp_data->ncp.n_ip >> 16) & 0x000000ff);
+
−      pos++;
+
−      pco_buf[pos] = (UBYTE)((ppp_data->ncp.n_ip >> 8) & 0x000000ff);
+
−      pos++;
+
−      pco_buf[pos] = (UBYTE)(ppp_data->ncp.n_ip & 0x000000ff);
+
−      pos++;
+
−    }
+
−
+
−    if(ppp_data->pco_mask & PPP_PCO_MASK_IPCP_PDNS)
+
−    {
+
−            /*
+
−             * primary DNS Address
+
−             */
+
−      pco_buf[pos] = TYPE_PDNS;
+
−      pos++;
+
−      pco_buf[pos] = LENGTH_PDNS;
+
−      pos++;
+
−      pco_buf[pos] = (UBYTE)(ppp_data->ncp.n_pdns >> 24);
+
−      pos++;
+
−      pco_buf[pos] = (UBYTE)((ppp_data->ncp.n_pdns >> 16) & 0x000000ff);
+
−      pos++;
+
−      pco_buf[pos] = (UBYTE)((ppp_data->ncp.n_pdns >> 8) & 0x000000ff);
+
−      pos++;
+
−      pco_buf[pos] = (UBYTE)(ppp_data->ncp.n_pdns & 0x000000ff);
+
−      pos++;
+
−    }
+
−
+
−    if(ppp_data->pco_mask & PPP_PCO_MASK_IPCP_SDNS)
+
−    {
+
−            /*
+
−             * secondary DNS Address
+
−             */
+
−      pco_buf[pos] = TYPE_SDNS;
+
−      pos++;
+
−      pco_buf[pos] = LENGTH_SDNS;
+
−      pos++;
+
−      pco_buf[pos] = (UBYTE)(ppp_data->ncp.n_sdns >> 24);
+
−      pos++;
+
−      pco_buf[pos] = (UBYTE)((ppp_data->ncp.n_sdns >> 16) & 0x000000ff);
+
−      pos++;
+
−      pco_buf[pos] = (UBYTE)((ppp_data->ncp.n_sdns >> 8) & 0x000000ff);
+
−      pos++;
+
−      pco_buf[pos] = (UBYTE)(ppp_data->ncp.n_sdns & 0x000000ff);
+
−      pos++;
+
−    }
+
−
+
−        /*
+
−         * insert packet length
+
−         */
+
−    pco_buf[len_pos2] = 0;
+
−    len_pos2++;
+
−    pco_buf[len_pos2] = (UBYTE)(pos - len_pos2 + 3);
+
−      /*
+
−       * insert Length of Protocol Contents
+
−       */
+
−    pco_buf[len_pos1] = pco_buf[len_pos2];
+
−
+
−    /*
+
−     * return new position
+
−     */
+
−    *ptr_pos=pos;
+
−  }
+
−
+
−  if(ppp_data->pco_mask & PPP_PCO_MASK_IPCP_GATEWAY)
+
−  {
+
−    pos=*ptr_pos;
+
−    /*
+
−     * create the Configure-NAK packet
+
−     */
+
−      /*
+
−       * Protocol ID
+
−       */
+
−    pco_buf[pos] = PROTOCOL_IPCP_MSB;
+
−    pos++;
+
−    pco_buf[pos] = PROTOCOL_IPCP_LSB;
+
−    pos++;
+
−      /*
+
−       * Length of Protocol contents (store the position)
+
−       */
+
−    len_pos1 = pos;
+
−    pos++;
+
−        /*
+
−         * Code field
+
−         */
+
−    pco_buf[pos] = CODE_CONF_NAK;
+
−    pos++;
+
−        /*
+
−         * Identifier field (some value)
+
−         */
+
−    pco_buf[pos] = 1;
+
−    pos++;
+
−        /*
+
−         * Length field (store the position)
+
−         */
+
−    len_pos2 = pos;
+
−    pos++;
+
−    pos++;
+
−
+
−          /*
+
−           * dynamic Gateway Address
+
−           */
+
−    pco_buf[pos] = TYPE_IP;
+
−    pos++;
+
−    pco_buf[pos] = LENGTH_IP;
+
−    pos++;
+
−    pco_buf[pos] = 0;
+
−    pos++;
+
−    pco_buf[pos] = 0;
+
−    pos++;
+
−    pco_buf[pos] = 0;
+
−    pos++;
+
−    pco_buf[pos] = 0;
+
−    pos++;
+
−
+
−        /*
+
−         * insert packet length
+
−         */
+
−    pco_buf[len_pos2] = 0;
+
−    len_pos2++;
+
−    pco_buf[len_pos2] = (UBYTE)(pos - len_pos2 + 3);
+
−      /*
+
−       * insert Length of Protocol Contents
+
−       */
+
−    pco_buf[len_pos1] = pco_buf[len_pos2];
+
−
+
−    /*
+
−     * return new position
+
−     */
+
−    *ptr_pos=pos;
+
−  }
+
−} /* ncp_fill_out_packet() */
+
−
+
−
+
−
+
−/*
+
−+------------------------------------------------------------------------------
+
−| Function    : ncp_analyze_pco
+
−+------------------------------------------------------------------------------
+
−| Description : The function ncp_analyze_pco() analyzes the return packet from
+
−|               PDP activation and determines the primary and secondary DNS
+
−|               address and the Gateway address.
+
−|
+
−| Parameters  : pco_buf     - pointer to the protocol configuration options
+
−|               pos         - position where the IPCP packet starts
+
−|               ptr_dns1    - returns primary DNS address
+
−|               ptr_dns2    - returns secondary DNS address
+
−|               ptr_gateway - returns Gateway address
+
−|
+
−+------------------------------------------------------------------------------
+
−*/
+
−GLOBAL void ncp_analyze_pco (UBYTE pco_buf[],
+
−                             USHORT pos,
+
−                             ULONG* ptr_dns1,
+
−                             ULONG* ptr_dns2,
+
−                             ULONG* ptr_gateway)
+
−{
+
−  USHORT  packet_len;
+
−  USHORT  start_pos;
+
−  UBYTE   type_len;
+
−  USHORT  analyzed;
+
−  ULONG   pdns;
+
−  ULONG   sdns;
+
−  ULONG   gateway;
+
−
+
−  TRACE_FUNCTION( "ncp_analyze_pco" );
+
−
+
−  /*
+
−   * check for correct length field
+
−   */
+
−  pos+= 2;
+
−  packet_len = pco_buf[pos + 3];
+
−  packet_len <<= 8;
+
−  packet_len+= pco_buf[pos + 4];
+
−  if(packet_len NEQ pco_buf[pos])
+
−    return;
+
−  pos++;
+
−  /*
+
−   * check of code field
+
−   */
+
−  if((pco_buf[pos] NEQ CODE_CONF_REQ) &&
+
−     (pco_buf[pos] NEQ CODE_CONF_NAK) &&
+
−     (pco_buf[pos] NEQ CODE_CONF_ACK))
+
−    return;
+
−  /*
+
−   * analyze configuration options
+
−   */
+
−  start_pos = pos;
+
−  pos+= 4;
+
−    /*
+
−     * analyzed is a bit field and marks all already analyzed
+
−     * configuration options in order to determine configuration options
+
−     * which are listed more than once
+
−     */
+
−  analyzed=0;
+
−  while((pos - start_pos) < packet_len)
+
−  {
+
−    type_len=pco_buf[pos + 1];
+
−    switch(pco_buf[pos])
+
−    {
+
−      /*
+
−       * search for IP configuration option
+
−       */
+
−      case TYPE_IP:
+
−        gateway = pco_buf[pos + 2];
+
−        gateway = (gateway << 8);
+
−        gateway+= pco_buf[pos + 3];
+
−        gateway = (gateway << 8);
+
−        gateway+= pco_buf[pos + 4];
+
−        gateway = (gateway << 8);
+
−        gateway+= pco_buf[pos + 5];
+
−        if(((analyzed & (1UL << MASK_TYPE_IP)) EQ 0) &&
+
−           (*ptr_gateway EQ PPP_GATEWAY_DEFAULT)     &&
+
−           (pco_buf[start_pos] EQ CODE_CONF_REQ))
+
−        {
+
−          analyzed|=(1UL << MASK_TYPE_IP);
+
−          *ptr_gateway = gateway;
+
−        }
+
−        break;
+
−
+
−      /*
+
−       * search for DNS configuration options
+
−       */
+
−      case TYPE_PDNS:
+
−        pdns = pco_buf[pos + 2];
+
−        pdns = (pdns << 8);
+
−        pdns+= pco_buf[pos + 3];
+
−        pdns = (pdns << 8);
+
−        pdns+= pco_buf[pos + 4];
+
−        pdns = (pdns << 8);
+
−        pdns+= pco_buf[pos + 5];
+
−        if(((analyzed & (1UL << MASK_TYPE_PDNS)) EQ 0) &&
+
−           (*ptr_dns1 EQ PPP_PDNS_DEFAULT)             &&
+
−           ((pco_buf[start_pos] EQ CODE_CONF_NAK) ||
+
−            (pco_buf[start_pos] EQ CODE_CONF_ACK)))
+
−        {
+
−          analyzed|=(1UL << MASK_TYPE_PDNS);
+
−          *ptr_dns1 = pdns;
+
−        }
+
−        break;
+
−
+
−      case TYPE_SDNS:
+
−        sdns = pco_buf[pos + 2];
+
−        sdns = (sdns << 8);
+
−        sdns+= pco_buf[pos + 3];
+
−        sdns = (sdns << 8);
+
−        sdns+= pco_buf[pos + 4];
+
−        sdns = (sdns << 8);
+
−        sdns+= pco_buf[pos + 5];
+
−        if(((analyzed & (1UL << MASK_TYPE_SDNS)) EQ 0) &&
+
−           (*ptr_dns2 EQ PPP_SDNS_DEFAULT)             &&
+
−           ((pco_buf[start_pos] EQ CODE_CONF_NAK) ||
+
−            (pco_buf[start_pos] EQ CODE_CONF_ACK)))
+
−        {
+
−          analyzed|=(1UL << MASK_TYPE_SDNS);
+
−          *ptr_dns2 = sdns;
+
−        }
+
−        break;
+
−      default:
+
−        /*
+
−         * other configuration options are not analysed
+
−         */
+
−        break;
+
−    }
+
−    pos+= type_len;
+
−  }
+
−} /* ncp_analyze_pco() */
+
−
+
−
+
−
+
−/*
+
−+------------------------------------------------------------------------------
+
−| Function    : ncp_rcr
+
−+------------------------------------------------------------------------------
+
−| Description : The function ncp_rcr() analyzes the given
+
−|               Configure Request packet and returns either FORWARD_RCRP or
+
−|               FORWARD_RCRN depend on the result of the analysis.
+
−|               The packet pointer points to an appropriate response packet.
+
−|
+
−| Parameters  : ptr_packet  - pointer to a Configure Request packet
+
−|               forward     - returns result of analysis
+
−|
+
−+------------------------------------------------------------------------------
+
−*/
+
−GLOBAL void ncp_rcr (T_desc2** ptr_packet, UBYTE* isnew, UBYTE* forward)
+
−{
+
−  T_desc2* packet;
+
−  USHORT   packet_len;
+
−  UBYTE    type_len;
+
−  USHORT   pos;
+
−  USHORT   copy_pos;
+
−  USHORT   analyzed;
+
−  UBYTE    code_ret;
+
−  UBYTE    error_found;
+
−  USHORT   protocol_hc;
+
−  UBYTE    csid;
+
−  ULONG    ip;
+
−  ULONG    pdns;
+
−  ULONG    sdns;
+
−
+
−  TRACE_FUNCTION( "ncp_rcr" );
+
−
+
−  /*
+
−   * check for correct length field
+
−   */
+
−  packet = *ptr_packet;
+
−  packet_len = packet->buffer[2];/*lint !e415 !e416 creation and access of out-of-bounds pointer */
+
−  packet_len <<= 8;
+
−  packet_len+= packet->buffer[3];/*lint !e415 !e416 creation and access of out-of-bounds pointer */
+
−  if((packet_len > packet->len) || (packet_len < 4))
+
−  {
+
−    *forward=FORWARD_DISCARD;
+
−    return;
+
−  }
+
−  /*
+
−   * check consistence of length of packet and length of configuration options
+
−   */
+
−  pos=5;
+
−  while(pos < packet_len)
+
−  {
+
−    if(packet->buffer[pos] < 2)/*lint !e662 !e661 possible creation and access of out-of-bounds pointer*/
+
−    {
+
−      *forward=FORWARD_DISCARD;
+
−      return;
+
−    }
+
−    pos += packet->buffer[pos];/*lint !e662 !e661 possible creation and access of out-of-bounds pointer*/
+
−  }
+
−  if((pos - 1) NEQ packet_len)
+
−  {
+
−    *forward=FORWARD_DISCARD;
+
−    return;
+
−  }
+
−  /*
+
−   * check whether it is a new identifier
+
−   */
+
−  *isnew=TRUE;
+
−  if((ppp_data->ncp.rcr) && (ppp_data->ncp.lrcri EQ packet->buffer[1]))/*lint !e415 access of out-of-bounds pointer */
+
−    *isnew=FALSE;
+
−  ppp_data->ncp.lrcri=packet->buffer[1];/*lint !e415 access of out-of-bounds pointer */
+
−  ppp_data->ncp.rcr=TRUE;
+
−  /*
+
−   * analyze configuration options
+
−   */
+
−  ppp_data->ncp.r_hc   = PPP_HC_DEFAULT;
+
−  ppp_data->ncp.r_msid = PPP_MSID_DEFAULT;
+
−  csid                 = 0;
+
−  if(ppp_data->mode EQ PPP_SERVER)
+
−  {
+
−    ppp_data->ncp.n_ip   = PPP_IP_DEFAULT;
+
−    ppp_data->ncp.n_pdns = PPP_PDNS_DEFAULT;
+
−    ppp_data->ncp.n_sdns = PPP_SDNS_DEFAULT;
+
−  }
+
−  pos=4;
+
−    /*
+
−     * position where NAKed or Rejected configuration options are copied to
+
−     */
+
−  copy_pos=4;
+
−    /*
+
−     * code_ret contains actually the status of analysis
+
−     * states are CODE_CONF_ACK, CODE_CONF_NAK and CODE_CONF_REJ
+
−     * this state are also values for the Code-field in the return packet
+
−     */
+
−  code_ret=CODE_CONF_ACK;
+
−    /*
+
−     * analyzed is a bit field and marks all already analyzed
+
−     * configuration options in order to reject all configuration options
+
−     * which are listed more than once
+
−     */
+
−  analyzed=0;
+
−  while(pos < packet_len)
+
−  {
+
−    type_len=packet->buffer[pos + 1];/*lint !e662 !e661 possible creation and access of out-of-bounds pointer*/
+
−    switch(packet->buffer[pos])/*lint !e662 !e661 possible creation and access of out-of-bounds pointer*/
+
−    {
+
−      /*
+
−       * yet supported configuration options
+
−       */
+
−      case TYPE_HC: /* Header Compression */
+
−        protocol_hc = packet->buffer[pos + 2];/*lint !e662 !e661 possible creation and access of out-of-bounds pointer*/
+
−        protocol_hc <<= 8;
+
−        protocol_hc+= packet->buffer[pos + 3];/*lint !e662 !e661 possible creation and access of out-of-bounds pointer*/
+
−        if(protocol_hc EQ DTI_PID_CTCP)
+
−        {
+
−          ppp_data->ncp.r_hc   = PPP_HC_VJ;
+
−          ppp_data->ncp.r_msid = packet->buffer[pos + 4];/*lint !e662 !e661 possible creation and access of out-of-bounds pointer*/
+
−          csid                 = packet->buffer[pos + 5];/*lint !e662 !e661 possible creation and access of out-of-bounds pointer*/
+
−        }
+
−
+
−        switch(code_ret)
+
−        {
+
−          case CODE_CONF_ACK:
+
−            if(((analyzed & (1UL << MASK_TYPE_HC)) EQ 0) &&
+
−               (ppp_data->ncp.r_hc EQ ppp_data->ncp.req_hc))
+
−            {
+
−              if((ppp_data->ncp.r_hc EQ PPP_HC_VJ) &&
+
−                 (type_len EQ LENGTH_HC_VJ))
+
−              {
+
−                if((ppp_data->mode EQ PPP_SERVER) &&
+
−                   (ppp_data->ncp.r_msid >= ppp_data->ncp.s_msid) &&
+
−                   (csid EQ PPP_CSID_YES) &&
+
−                   (ppp_data->ncp.s_hc EQ PPP_HC_VJ))
+
−                {
+
−                  analyzed|=(1UL << MASK_TYPE_HC);
+
−                  pos+= LENGTH_HC_VJ;
+
−                  break;
+
−                }
+
−                /*
+
−                 * include here negotiation in client mode
+
−                 */
+
−              }
+
−              /*
+
−               * include here additional header compression protocols
+
−               */
+
−            }
+
−            code_ret=CODE_CONF_NAK;
+
−            /* fall through */
+
−          case CODE_CONF_NAK:
+
−            /*
+
−             * this configuration option will NAKed only if the compression
+
−             * protocol is not Van Jacobson Header Compression
+
−             */
+
−            if(((analyzed & (1UL << MASK_TYPE_HC)) EQ 0) &&
+
−               (ppp_data->ncp.req_hc NEQ PPP_HC_DEFAULT) &&
+
−               (ppp_data->ncp.s_hc EQ PPP_HC_VJ) &&
+
−               ((protocol_hc NEQ DTI_PID_CTCP) ||
+
−                (type_len NEQ LENGTH_HC_VJ) ||
+
−                ((ppp_data->ncp.r_msid >= ppp_data->ncp.s_msid) &&
+
−                 (csid EQ PPP_CSID_YES))))
+
−            {
+
−              analyzed|= (1UL << MASK_TYPE_HC);
+
−
+
−              error_found = FALSE;
+
−              /*
+
−               * this implementation is only for server mode
+
−               */
+
−              if(type_len < LENGTH_HC_VJ)
+
−              {
+
−                T_desc2* temp_desc;
+
−
+
−                /*
+
−                 * create a new larger packet and copy the content
+
−                 * of the old packet into the new
+
−                 */
+
−                MALLOC (temp_desc, (USHORT)(sizeof(T_desc2) - 1
+
−                                                           + packet_len
+
−                                                           + LENGTH_HC_VJ
+
−                                                           - type_len));
+
−                temp_desc->next = packet->next;
+
−                temp_desc->len  = packet_len + LENGTH_HC_VJ - type_len;
+
−                memcpy(temp_desc->buffer, packet->buffer, pos);/*lint !e669 !e670 possible data overrun*/
+
−                memcpy(&temp_desc->buffer[pos + LENGTH_HC_VJ - type_len],
+
−                       &packet->buffer[pos],
+
−                       packet_len - pos);/*lint !e662 !e669 !e670 possible creation of out-of-bounds pointer*/
+
−                arb_discard_packet(packet);
+
−                packet_len+= (LENGTH_HC_VJ - type_len);
+
−                pos       += (LENGTH_HC_VJ - type_len);
+
−                packet     = temp_desc;
+
−
+
−                error_found = TRUE;
+
−              }
+
−              else if(ppp_data->ncp.r_hc NEQ PPP_HC_VJ)
+
−              {
+
−                error_found = TRUE;
+
−              }
+
−              else if(type_len > LENGTH_HC_VJ)
+
−              {
+
−                error_found = TRUE;
+
−              }
+
−              if(error_found EQ TRUE)
+
−              {
+
−                packet->buffer[copy_pos] = TYPE_HC;/*lint !e662 !e661 possible creation and access of out-of-bounds pointer*/
+
−                copy_pos++;
+
−                packet->buffer[copy_pos] = LENGTH_HC_VJ;/*lint !e662 !e661 possible creation and access of out-of-bounds pointer*/
+
−                copy_pos++;
+
−                packet->buffer[copy_pos] = PROTOCOL_VJ_MSB;/*lint !e662 !e661 possible creation and access of out-of-bounds pointer*/
+
−                copy_pos++;
+
−                packet->buffer[copy_pos] = PROTOCOL_VJ_LSB;/*lint !e662 !e661 possible creation and access of out-of-bounds pointer*/
+
−                copy_pos++;
+
−                packet->buffer[copy_pos] = ppp_data->ncp.req_msid;/*lint !e662 !e661 possible creation and access of out-of-bounds pointer*/
+
−                copy_pos++;
+
−                packet->buffer[copy_pos] = PPP_CSID_YES;/*lint !e662 !e661 possible creation and access of out-of-bounds pointer*/
+
−                copy_pos++;
+
−              }
+
−              pos+= type_len;
+
−              break;
+
−            }
+
−            code_ret = CODE_CONF_REJ;
+
−            copy_pos = 4;
+
−            /* fall through */
+
−          case CODE_CONF_REJ:
+
−            if(((analyzed & (1UL << MASK_TYPE_HC)) EQ 0) &&
+
−               (ppp_data->ncp.req_hc NEQ PPP_HC_DEFAULT) &&
+
−               (ppp_data->ncp.s_hc EQ PPP_HC_VJ) &&
+
−               ((ppp_data->ncp.s_rejected & (1UL << MASK_TYPE_HC)) EQ 0) &&
+
−               ((protocol_hc NEQ DTI_PID_CTCP) ||
+
−                (type_len NEQ LENGTH_HC_VJ) ||
+
−                ((ppp_data->ncp.r_msid >= ppp_data->ncp.s_msid) &&
+
−                 (csid EQ PPP_CSID_YES))))
+
−            {
+
−              analyzed|= (1UL << MASK_TYPE_HC);
+
−              pos+= type_len;
+
−              break;
+
−            }
+
−            /*
+
−             * set s_hc to default because we reject this configuration option
+
−             */
+
−            ppp_data->ncp.s_hc = PPP_HC_DEFAULT;
+
−            while(type_len > 0)
+
−            {
+
−              packet->buffer[copy_pos]=packet->buffer[pos];/*lint !e662 !e661 possible creation and access of out-of-bounds pointer*/
+
−              copy_pos++;
+
−              pos++;
+
−              type_len--;
+
−            }
+
−            break;
+
−          default:
+
−            TRACE_ERROR("Packet return code invalid");
+
−            break;
+
−        }
+
−        break;
+
−      case TYPE_IP:
+
−        ip = packet->buffer[pos + 2];/*lint !e662 !e661 possible creation and access of out-of-bounds pointer*/
+
−        ip = (ip << 8);
+
−        ip+= packet->buffer[pos + 3];/*lint !e662 !e661 possible creation and access of out-of-bounds pointer*/
+
−        ip = (ip << 8);
+
−        ip+= packet->buffer[pos + 4];/*lint !e662 !e661 possible creation and access of out-of-bounds pointer*/
+
−        ip = (ip << 8);
+
−        ip+= packet->buffer[pos + 5];/*lint !e662 !e661 possible creation and access of out-of-bounds pointer*/
+
−
+
−        switch(code_ret)
+
−        {
+
−          case CODE_CONF_ACK:
+
−            if(((analyzed & (1UL << MASK_TYPE_IP)) EQ 0) &&
+
−               (type_len EQ LENGTH_IP))
+
−            {
+
−              if((ppp_data->mode EQ PPP_SERVER) &&
+
−                 (((ip EQ ppp_data->ncp.req_ip) &&
+
−                   (ppp_data->ncp.req_ip NEQ PPP_IP_DEFAULT)) ||
+
−                  ((ip NEQ PPP_IP_DEFAULT) &&
+
−                   (ppp_data->ncp.req_ip EQ PPP_IP_DEFAULT))))
+
−              {
+
−                analyzed|=(1UL << MASK_TYPE_IP);
+
−                ppp_data->ncp.n_ip = ip;
+
−                pos+=LENGTH_IP;
+
−                break;
+
−              }
+
−              else if((ppp_data->mode EQ PPP_CLIENT) &&
+
−                      (ip NEQ PPP_IP_DEFAULT))
+
−              {
+
−                /*
+
−                 * accept Gateway address
+
−                 */
+
−                analyzed|=(1UL << MASK_TYPE_IP);
+
−                ppp_data->ncp.n_gateway = ip;
+
−                pos+=LENGTH_IP;
+
−                break;
+
−              }
+
−            }
+
−            code_ret=CODE_CONF_NAK;
+
−            /* fall through */
+
−          case CODE_CONF_NAK:
+
−            /*
+
−             * this option will be rejected in following cases:
+
−             * - occurence more than once
+
−             * - in client mode if received IP is dynamic
+
−             * - in server mode if received and requested IP are dynamic
+
−             */
+
−            if(((analyzed & (1UL << MASK_TYPE_IP)) EQ 0) &&
+
−               (((ppp_data->mode EQ PPP_SERVER) &&
+
−                 ((ip NEQ ppp_data->ncp.req_ip) ||
+
−                  (ppp_data->ncp.req_ip NEQ PPP_IP_DEFAULT))) ||
+
−                ((ppp_data->mode EQ PPP_CLIENT) &&
+
−                 (ip NEQ PPP_IP_DEFAULT))))
+
−            {
+
−              analyzed|=(1UL << MASK_TYPE_IP);
+
−
+
−              error_found=FALSE;
+
−              if(type_len < LENGTH_IP)
+
−              {
+
−                T_desc2* temp_desc;
+
−
+
−                /*
+
−                 * create a new larger packet and copy the content
+
−                 * of the old packet into the new
+
−                 */
+
−                MALLOC (temp_desc, (USHORT)(sizeof(T_desc2) - 1
+
−                                                           + packet_len
+
−                                                           + LENGTH_IP
+
−                                                           - type_len));
+
−                temp_desc->next = packet->next;
+
−                temp_desc->len  = packet_len + LENGTH_IP - type_len;
+
−                memcpy(temp_desc->buffer, packet->buffer, pos);/*lint !e669 !e670 Possible data overrun*/
+
−                memcpy(&temp_desc->buffer[pos + LENGTH_IP - type_len],
+
−                       &packet->buffer[pos],
+
−                       packet_len - pos);/*lint !e662 !e669 !e670 possible creation of out-of-bounds pointer*/
+
−                arb_discard_packet(packet);
+
−                packet_len += (LENGTH_IP - type_len);
+
−                pos        += (LENGTH_IP - type_len);
+
−                packet      = temp_desc;
+
−                error_found = TRUE;
+
−              }
+
−              else if((ip NEQ ppp_data->ncp.req_ip) &&
+
−                      (ppp_data->ncp.req_ip NEQ PPP_IP_DEFAULT) &&
+
−                      (ppp_data->mode EQ PPP_SERVER))
+
−              {
+
−                error_found=TRUE;
+
−              }
+
−              else if(type_len > LENGTH_IP)
+
−              {
+
−                error_found=TRUE;
+
−              }
+
−              if(error_found EQ TRUE)
+
−              {
+
−                packet->buffer[copy_pos]=TYPE_IP;/*lint !e662 !e661 possible creation and access of out-of-bounds pointer*/
+
−                copy_pos++;
+
−                packet->buffer[copy_pos]=LENGTH_IP;/*lint !e662 !e661 possible creation and access of out-of-bounds pointer*/
+
−                copy_pos++;
+
−                packet->buffer[copy_pos]=(UBYTE)(ppp_data->ncp.req_ip >> 24);/*lint !e662 !e661 possible creation and access of out-of-bounds pointer*/
+
−                copy_pos++;
+
−                packet->buffer[copy_pos]=(UBYTE)((ppp_data->ncp.req_ip >> 16)
+
−                                                 & 0x000000ff);/*lint !e662 !e661 possible creation and access of out-of-bounds pointer*/
+
−                copy_pos++;
+
−                packet->buffer[copy_pos]=(UBYTE)((ppp_data->ncp.req_ip >>  8)
+
−                                                 & 0x000000ff);/*lint !e662 !e661 possible creation and access of out-of-bounds pointer*/
+
−                copy_pos++;
+
−                packet->buffer[copy_pos]=(UBYTE)(ppp_data->ncp.req_ip
+
−                                                 & 0x000000ff);/*lint !e662 !e661 possible creation and access of out-of-bounds pointer*/
+
−                copy_pos++;
+
−              }
+
−              pos+= type_len;
+
−              break;
+
−            }
+
−            code_ret = CODE_CONF_REJ;
+
−            copy_pos = 4;
+
−            /* fall through */
+
−          case CODE_CONF_REJ:
+
−            if(((analyzed & (1UL << MASK_TYPE_IP)) EQ 0) &&
+
−               (((ppp_data->mode EQ PPP_SERVER) &&
+
−                 ((ip NEQ ppp_data->ncp.req_ip) ||
+
−                  (ppp_data->ncp.req_ip NEQ PPP_IP_DEFAULT))) ||
+
−                ((ppp_data->mode EQ PPP_CLIENT) &&
+
−                 (ip NEQ PPP_IP_DEFAULT))))
+
−            {
+
−              analyzed|=(1UL << MASK_TYPE_IP);
+
−              pos+=type_len;
+
−              break;
+
−            }
+
−            while(type_len > 0)
+
−            {
+
−              packet->buffer[copy_pos]=packet->buffer[pos];/*lint !e662 !e661 possible creation and access of out-of-bounds pointer*/
+
−              copy_pos++;
+
−              pos++;
+
−              type_len--;
+
−            }
+
−            break;
+
−          default:
+
−            TRACE_ERROR("Packet return code invalid");
+
−            break;
+
−        }
+
−        break;
+
−      case TYPE_PDNS:  /* only in server mode allowed */
+
−        pdns = packet->buffer[pos + 2];/*lint !e662 !e661 possible creation and access of out-of-bounds pointer*/
+
−        pdns = (pdns << 8);
+
−        pdns+= packet->buffer[pos + 3];/*lint !e662 !e661 possible creation and access of out-of-bounds pointer*/
+
−        pdns = (pdns << 8);
+
−        pdns+= packet->buffer[pos + 4];/*lint !e662 !e661 possible creation and access of out-of-bounds pointer*/
+
−        pdns = (pdns << 8);
+
−        pdns+= packet->buffer[pos + 5];/*lint !e662 !e661 possible creation and access of out-of-bounds pointer*/
+
−
+
−        switch(code_ret)
+
−        {
+
−          case CODE_CONF_ACK:
+
−            if(((analyzed & (1UL << MASK_TYPE_PDNS)) EQ 0) &&
+
−               (ppp_data->mode EQ PPP_SERVER) &&
+
−               (type_len EQ LENGTH_PDNS) &&
+
−               (((pdns EQ ppp_data->ncp.req_pdns) &&
+
−                 (ppp_data->ncp.req_pdns NEQ PPP_PDNS_DEFAULT)) ||
+
−                ((pdns NEQ PPP_PDNS_DEFAULT) &&
+
−                 (ppp_data->ncp.req_pdns EQ PPP_PDNS_DEFAULT))))
+
−            {
+
−              analyzed|=(1UL << MASK_TYPE_PDNS);
+
−              ppp_data->ncp.n_pdns = pdns;
+
−              pos+= LENGTH_PDNS;
+
−              break;
+
−            }
+
−            code_ret=CODE_CONF_NAK;
+
−            /* fall through */
+
−          case CODE_CONF_NAK:
+
−            /*
+
−             * this option will be rejected in following cases:
+
−             * - occurence more than once
+
−             * - client mode
+
−             * - received and requested PDNS are dynamic
+
−             */
+
−            if(((analyzed & (1UL << MASK_TYPE_PDNS)) EQ 0) &&
+
−               (ppp_data->mode EQ PPP_SERVER) &&
+
−               ((pdns NEQ ppp_data->ncp.req_pdns) ||
+
−                (ppp_data->ncp.req_pdns NEQ PPP_PDNS_DEFAULT)))
+
−            {
+
−              analyzed|=(1UL << MASK_TYPE_PDNS);
+
−
+
−              error_found=FALSE;
+
−              if(type_len < LENGTH_PDNS)
+
−              {
+
−                T_desc2* temp_desc;
+
−
+
−                /*
+
−                 * create a new larger packet and copy the content
+
−                 * of the old packet into the new
+
−                 */
+
−                MALLOC (temp_desc, (USHORT)(sizeof(T_desc2) - 1
+
−                                                           + packet_len
+
−                                                           + LENGTH_PDNS
+
−                                                           - type_len));
+
−                temp_desc->next = packet->next;
+
−                temp_desc->len  = packet_len + LENGTH_PDNS - type_len;
+
−                memcpy(temp_desc->buffer, packet->buffer, pos);/*lint !e669 !e670 Possible data overrun*/
+
−                memcpy(&temp_desc->buffer[pos + LENGTH_PDNS - type_len],
+
−                       &packet->buffer[pos],
+
−                       packet_len - pos);/*lint !e662 !e669 !e670 possible creation of out-of-bounds pointer*/
+
−                arb_discard_packet(packet);
+
−                packet_len += (LENGTH_PDNS - type_len);
+
−                pos        += (LENGTH_PDNS - type_len);
+
−                packet      = temp_desc;
+
−                error_found = TRUE;
+
−              }
+
−              else if((pdns NEQ ppp_data->ncp.req_pdns) &&
+
−                      (ppp_data->ncp.req_pdns NEQ PPP_PDNS_DEFAULT))
+
−              {
+
−                error_found=TRUE;
+
−              }
+
−              else if(type_len > LENGTH_PDNS)
+
−              {
+
−                error_found=TRUE;
+
−              }
+
−              if(error_found EQ TRUE)
+
−              {
+
−                packet->buffer[copy_pos]=TYPE_PDNS;/*lint !e662 !e661 possible creation and access of out-of-bounds pointer*/
+
−                copy_pos++;
+
−                packet->buffer[copy_pos]=LENGTH_PDNS;/*lint !e662 !e661 possible creation and access of out-of-bounds pointer*/
+
−                copy_pos++;
+
−                packet->buffer[copy_pos]=(UBYTE)(ppp_data->ncp.req_pdns >> 24);/*lint !e662 !e661 possible creation and access of out-of-bounds pointer*/
+
−                copy_pos++;
+
−                packet->buffer[copy_pos]=(UBYTE)((ppp_data->ncp.req_pdns >> 16)
+
−                                                 & 0x000000ff);/*lint !e662 !e661 possible creation and access of out-of-bounds pointer*/
+
−                copy_pos++;
+
−                packet->buffer[copy_pos]=(UBYTE)((ppp_data->ncp.req_pdns >>  8)
+
−                                                 & 0x000000ff);/*lint !e662 !e661 possible creation and access of out-of-bounds pointer*/
+
−                copy_pos++;
+
−                packet->buffer[copy_pos]=(UBYTE)(ppp_data->ncp.req_pdns
+
−                                                 & 0x000000ff);/*lint !e662 !e661 possible creation and access of out-of-bounds pointer*/
+
−                copy_pos++;
+
−              }
+
−              pos+= type_len;
+
−              break;
+
−            }
+
−            code_ret = CODE_CONF_REJ;
+
−            copy_pos = 4;
+
−            /* fall through */
+
−          case CODE_CONF_REJ:
+
−            if(((analyzed & (1UL << MASK_TYPE_PDNS)) EQ 0) &&
+
−               (ppp_data->mode EQ PPP_SERVER) &&
+
−               ((pdns NEQ ppp_data->ncp.req_pdns) ||
+
−                (ppp_data->ncp.req_pdns NEQ PPP_PDNS_DEFAULT)))
+
−            {
+
−              analyzed|=(1UL << MASK_TYPE_PDNS);
+
−              pos+=type_len;
+
−              break;
+
−            }
+
−            while(type_len > 0)
+
−            {
+
−              packet->buffer[copy_pos]=packet->buffer[pos];/*lint !e662 !e661 possible creation and access of out-of-bounds pointer*/
+
−              copy_pos++;
+
−              pos++;
+
−              type_len--;
+
−            }
+
−            break;
+
−          default:
+
−            TRACE_ERROR("Packet return code invalid");
+
−            break;
+
−        }
+
−        break;
+
−      case TYPE_SDNS:  /* only in server mode allowed */
+
−        sdns = packet->buffer[pos + 2];/*lint !e662 !e661 possible creation and access of out-of-bounds pointer*/
+
−        sdns = (sdns << 8);
+
−        sdns+= packet->buffer[pos + 3];/*lint !e662 !e661 possible creation and access of out-of-bounds pointer*/
+
−        sdns = (sdns << 8);
+
−        sdns+= packet->buffer[pos + 4];/*lint !e662 !e661 possible creation and access of out-of-bounds pointer*/
+
−        sdns = (sdns << 8);
+
−        sdns+= packet->buffer[pos + 5];/*lint !e662 !e661 possible creation and access of out-of-bounds pointer*/
+
−
+
−        switch(code_ret)
+
−        {
+
−          case CODE_CONF_ACK:
+
−            if(((analyzed & (1UL << MASK_TYPE_SDNS)) EQ 0) &&
+
−               (ppp_data->mode EQ PPP_SERVER) &&
+
−               (type_len EQ LENGTH_SDNS) &&
+
−               (((sdns EQ ppp_data->ncp.req_sdns) &&
+
−                 (ppp_data->ncp.req_sdns NEQ PPP_SDNS_DEFAULT)) ||
+
−                ((sdns NEQ PPP_SDNS_DEFAULT) &&
+
−                 (ppp_data->ncp.req_sdns EQ PPP_SDNS_DEFAULT))))
+
−            {
+
−              analyzed|=(1UL << MASK_TYPE_SDNS);
+
−              ppp_data->ncp.n_sdns = sdns;
+
−              pos+= LENGTH_SDNS;
+
−              break;
+
−            }
+
−            code_ret=CODE_CONF_NAK;
+
−            /* fall through */
+
−          case CODE_CONF_NAK:
+
−            /*
+
−             * this option will be rejected in following cases:
+
−             * - occurence more than once
+
−             * - client mode
+
−             * - received and requested SDNS are dynamic
+
−             */
+
−            if(((analyzed & (1UL << MASK_TYPE_SDNS)) EQ 0) &&
+
−               (ppp_data->mode EQ PPP_SERVER) &&
+
−               ((sdns NEQ ppp_data->ncp.req_sdns) ||
+
−                (ppp_data->ncp.req_sdns NEQ PPP_SDNS_DEFAULT)))
+
−            {
+
−              analyzed|=(1UL << MASK_TYPE_SDNS);
+
−
+
−              error_found=FALSE;
+
−              if(type_len < LENGTH_SDNS)
+
−              {
+
−                T_desc2* temp_desc;
+
−
+
−                /*
+
−                 * create a new larger packet and copy the content
+
−                 * of the old packet into the new
+
−                 */
+
−                MALLOC (temp_desc, (USHORT)(sizeof(T_desc2) - 1
+
−                                                           + packet_len
+
−                                                           + LENGTH_SDNS
+
−                                                           - type_len));
+
−                temp_desc->next = packet->next;
+
−                temp_desc->len  = packet_len + LENGTH_SDNS - type_len;
+
−                memcpy(temp_desc->buffer, packet->buffer, pos);/*lint !e669 !e670 Possible data overrun*/
+
−                memcpy(&temp_desc->buffer[pos + LENGTH_SDNS - type_len],
+
−                       &packet->buffer[pos],
+
−                       packet_len - pos);/*lint !e662 !e669 !e670 possible creation  of out-of-bounds pointer*/
+
−                arb_discard_packet(packet);
+
−                packet_len += (LENGTH_SDNS - type_len);
+
−                pos        += (LENGTH_SDNS - type_len);
+
−                packet      = temp_desc;
+
−                error_found = TRUE;
+
−              }
+
−              else if((sdns NEQ ppp_data->ncp.req_sdns) &&
+
−                      (ppp_data->ncp.req_sdns NEQ PPP_SDNS_DEFAULT))
+
−              {
+
−                error_found=TRUE;
+
−              }
+
−              else if(type_len > LENGTH_SDNS)
+
−              {
+
−                error_found=TRUE;
+
−              }
+
−              if(error_found EQ TRUE)
+
−              {
+
−                packet->buffer[copy_pos]=TYPE_SDNS;/*lint !e662 !e661 possible creation and access of out-of-bounds pointer*/
+
−                copy_pos++;
+
−                packet->buffer[copy_pos]=LENGTH_SDNS;/*lint !e662 !e661 possible creation and access of out-of-bounds pointer*/
+
−                copy_pos++;
+
−                packet->buffer[copy_pos]=(UBYTE)(ppp_data->ncp.req_sdns >> 24);/*lint !e662 !e661 possible creation and access of out-of-bounds pointer*/
+
−                copy_pos++;
+
−                packet->buffer[copy_pos]=(UBYTE)((ppp_data->ncp.req_sdns >> 16)
+
−                                                 & 0x000000ff);/*lint !e662 !e661 possible creation and access of out-of-bounds pointer*/
+
−                copy_pos++;
+
−                packet->buffer[copy_pos]=(UBYTE)((ppp_data->ncp.req_sdns >>  8)
+
−                                                 & 0x000000ff);/*lint !e662 !e661 possible creation and access of out-of-bounds pointer*/
+
−                copy_pos++;
+
−                packet->buffer[copy_pos]=(UBYTE)(ppp_data->ncp.req_sdns
+
−                                                 & 0x000000ff);/*lint !e662 !e661 possible creation and access of out-of-bounds pointer*/
+
−                copy_pos++;
+
−              }
+
−              pos+= type_len;
+
−              break;
+
−            }
+
−            code_ret = CODE_CONF_REJ;
+
−            copy_pos = 4;
+
−            /* fall through */
+
−          case CODE_CONF_REJ:
+
−            if(((analyzed & (1UL << MASK_TYPE_SDNS)) EQ 0) &&
+
−               (ppp_data->mode EQ PPP_SERVER) &&
+
−               ((sdns NEQ ppp_data->ncp.req_sdns) ||
+
−                (ppp_data->ncp.req_sdns NEQ PPP_SDNS_DEFAULT)))
+
−            {
+
−              analyzed|=(1UL << MASK_TYPE_SDNS);
+
−              pos+=type_len;
+
−              break;
+
−            }
+
−            while(type_len > 0)
+
−            {
+
−              packet->buffer[copy_pos]=packet->buffer[pos];/*lint !e662 !e661 possible creation and access of out-of-bounds pointer*/
+
−              copy_pos++;
+
−              pos++;
+
−              type_len--;
+
−            }
+
−            break;
+
−          default:
+
−            TRACE_ERROR("Packet return code invalid");
+
−            break;
+
−        }
+
−        break;
+
−      default:
+
−        switch(code_ret)
+
−        {
+
−          case CODE_CONF_ACK:
+
−          case CODE_CONF_NAK:
+
−            code_ret=CODE_CONF_REJ;
+
−            copy_pos=4;
+
−            /* fall through */
+
−          default:
+
−            while(type_len > 0)
+
−            {
+
−              packet->buffer[copy_pos]=packet->buffer[pos];/*lint !e662 !e661 possible creation and access of out-of-bounds pointer*/
+
−              copy_pos++;
+
−              pos++;
+
−              type_len--;
+
−            }
+
−            break;
+
−        }
+
−    }
+
−  }
+
−  if(((analyzed & (1UL << MASK_TYPE_HC)) EQ 0) &&
+
−     (ppp_data->ncp.s_hc EQ PPP_HC_VJ) &&
+
−     (ppp_data->ncp.req_hc EQ PPP_HC_VJ) &&
+
−     (code_ret NEQ CODE_CONF_REJ))
+
−  {
+
−    T_desc2* temp_desc;
+
−    /*
+
−     * add header compression to the configure Nak packet
+
−     */
+
−    code_ret = CODE_CONF_NAK;
+
−    /*
+
−     * create a new larger packet and copy the content
+
−     * of the old packet into the new
+
−     */
+
−    MALLOC (temp_desc, (USHORT)(sizeof(T_desc2) - 1
+
−                                               + packet_len
+
−                                               + LENGTH_HC_VJ));
+
−    temp_desc->next = packet->next;
+
−    temp_desc->len  = packet_len + LENGTH_HC_VJ;
+
−    memcpy(temp_desc->buffer, packet->buffer, copy_pos);/*lint !e669 !e670 Possible data overrun*/
+
−    arb_discard_packet(packet);
+
−    packet_len+= LENGTH_HC_VJ;
+
−    packet     = temp_desc;
+
−    /*
+
−     * insert header compression option
+
−     */
+
−    packet->buffer[copy_pos] = TYPE_HC;/*lint !e662 !e661 possible creation and access of out-of-bounds pointer*/
+
−    copy_pos++;
+
−    packet->buffer[copy_pos] = LENGTH_HC_VJ;/*lint !e662 !e661 possible creation and access of out-of-bounds pointer*/
+
−    copy_pos++;
+
−    packet->buffer[copy_pos] = PROTOCOL_VJ_MSB;/*lint !e662 !e661 possible creation and access of out-of-bounds pointer*/
+
−    copy_pos++;
+
−    packet->buffer[copy_pos] = PROTOCOL_VJ_LSB;/*lint !e662 !e661 possible creation and access of out-of-bounds pointer*/
+
−    copy_pos++;
+
−    packet->buffer[copy_pos] = ppp_data->ncp.req_msid;/*lint !e662 !e661 possible creation and access of out-of-bounds pointer*/
+
−    copy_pos++;
+
−    packet->buffer[copy_pos] = PPP_CSID_YES;/*lint !e662 !e661 possible creation and access of out-of-bounds pointer*/
+
−    copy_pos++;
+
−  }
+
−  /*
+
−   * set new Code field in return packet
+
−   */
+
−  packet->buffer[0]=code_ret;
+
−  *ptr_packet=packet;
+
−
+
−  if(copy_pos > 4)
+
−  {
+
−    /*
+
−     * some configuration options are not acceptable
+
−     */
+
−    *forward=FORWARD_RCRN;
+
−      /*
+
−       * set new Length field
+
−       */
+
−    packet->len=copy_pos;
+
−    packet->buffer[2]=(UBYTE)(copy_pos >> 8);/*lint !e415 !e416 creation and access of out-of-bounds pointer */
+
−    packet->buffer[3]=(UBYTE)(copy_pos & 0x00ff);/*lint !e415 !e416 creation and access of out-of-bounds pointer */
+
−    return;
+
−  }
+
−  /*
+
−   * all configuration options are acceptable
+
−   */
+
−  *forward=FORWARD_RCRP;
+
−} /* ncp_rcr() */
+
−
+
−
+
−
+
−/*
+
−+------------------------------------------------------------------------------
+
−| Function    : ncp_rca
+
−+------------------------------------------------------------------------------
+
−| Description : The function ncp_rca() checks whether the given
+
−|               Configure Ack packet is valid and if so it returns
+
−|               FORWARD_RCA. Otherwise it returns FORWARD_DISCARD.
+
−|
+
−| Parameters  : packet  - Configure Ack packet
+
−|               forward - returns result of analysis
+
−|
+
−+------------------------------------------------------------------------------
+
−*/
+
−GLOBAL void ncp_rca (T_desc2* packet, UBYTE* forward)
+
−{
+
−  USHORT  packet_len;
+
−
+
−  TRACE_FUNCTION( "ncp_rca" );
+
−
+
−  packet_len = packet->buffer[2];/*lint !e415 !e416 creation and access of out-of-bounds pointer */
+
−  packet_len <<= 8;
+
−  packet_len+= packet->buffer[3];/*lint !e415 !e416 creation and access of out-of-bounds pointer */
+
−  if((packet_len < 4) ||
+
−     (packet_len > packet->len) ||
+
−     (ppp_data->ncp.scr EQ FALSE) ||
+
−     (packet->buffer[1] NEQ ppp_data->ncp.nscri))/*lint !e415 access of out-of-bounds pointer */
+
−  {
+
−    /*
+
−     * invalid packet
+
−     */
+
−    *forward=FORWARD_DISCARD;
+
−    return;
+
−  }
+
−  /*
+
−   * acceptable packet
+
−   */
+
−  arb_discard_packet(packet);
+
−  ppp_data->ncp.nscri++;
+
−  *forward=FORWARD_RCA;
+
−} /* ncp_rca() */
+
−
+
−
+
−
+
−/*
+
−+------------------------------------------------------------------------------
+
−| Function    : ncp_rcn
+
−+------------------------------------------------------------------------------
+
−| Description : The function ncp_rcn() analyze the given
+
−|               Configure Nak packet, changes some requested values and returns
+
−|               FORWARD_RCN
+
−|               The packet pointer points to an appropriate response packet.
+
−|
+
−| Parameters  : ptr_packet - Configure Nak packet
+
−|               forward    - returns result of analysis
+
−|
+
−+------------------------------------------------------------------------------
+
−*/
+
−GLOBAL void ncp_rcn (T_desc2** ptr_packet, UBYTE* forward)
+
−{
+
−  T_desc2* packet;
+
−  USHORT   packet_len;
+
−  UBYTE    type_len;
+
−  USHORT   pos;
+
−  USHORT   protocol_hc;
+
−  ULONG    ip;
+
−  ULONG    pdns;
+
−  ULONG    sdns;
+
−
+
−  TRACE_FUNCTION( "ncp_rcn" );
+
−
+
−  /*
+
−   * check for correct length field
+
−   */
+
−  packet = *ptr_packet;
+
−  packet_len = packet->buffer[2];/*lint !e415 !e416 creation and access of out-of-bounds pointer */
+
−  packet_len <<= 8;
+
−  packet_len+= packet->buffer[3];/*lint !e415 !e416 creation and access of out-of-bounds pointer */
+
−  if((packet_len > packet->len) ||
+
−     (packet_len < 4) ||
+
−     (ppp_data->ncp.scr EQ FALSE) ||
+
−     (packet->buffer[1] NEQ ppp_data->ncp.nscri))/*lint !e415 access of out-of-bounds pointer */
+
−  {
+
−    /*
+
−     * invalid packet
+
−     */
+
−    *forward=FORWARD_DISCARD;
+
−    return;
+
−  }
+
−  /*
+
−   * check consistence of length of packet and length of configuration options
+
−   */
+
−  pos=5;
+
−  while(pos < packet_len)
+
−  {
+
−    if(packet->buffer[pos] < 2)/*lint !e662 !e661 possible creation and access of out-of-bounds pointer*/
+
−    {
+
−      *forward=FORWARD_DISCARD;
+
−      return;
+
−    }
+
−    pos+= packet->buffer[pos];/*lint !e662 !e661 possible creation and access of out-of-bounds pointer*/
+
−  }
+
−  if((pos - 1) NEQ packet_len)
+
−  {
+
−    *forward=FORWARD_DISCARD;
+
−    return;
+
−  }
+
−  /*
+
−   * analyze configuration options
+
−   */
+
−  pos=4;
+
−  while(pos < packet_len)
+
−  {
+
−    type_len=packet->buffer[pos + 1];/*lint !e662 !e661 possible creation and access of out-of-bounds pointer*/
+
−    switch(packet->buffer[pos])/*lint !e662 !e661 possible creation and access of out-of-bounds pointer*/
+
−    {
+
−      /*
+
−       * yet supported configuration options
+
−       */
+
−      case TYPE_HC:
+
−        protocol_hc = packet->buffer[pos + 2];/*lint !e662 !e661 possible creation and access of out-of-bounds pointer*/
+
−        protocol_hc <<= 8;
+
−        protocol_hc+= packet->buffer[pos + 3];/*lint !e662 !e661 possible creation and access of out-of-bounds pointer*/
+
−        if((protocol_hc EQ DTI_PID_CTCP) &&
+
−           (ppp_data->ncp.req_hc EQ PPP_HC_VJ) &&
+
−           (type_len EQ LENGTH_HC_VJ))
+
−        {
+
−          ppp_data->ncp.s_rejected &= ~(1UL << MASK_TYPE_HC);
+
−          ppp_data->ncp.s_hc        = PPP_HC_VJ;
+
−          ppp_data->ncp.s_msid      = ppp_data->ncp.req_msid;
+
−        }
+
−        break;
+
−      case TYPE_IP:
+
−        ip = packet->buffer[pos + 2];/*lint !e662 !e661 possible creation and access of out-of-bounds pointer*/
+
−        ip = ip << 8;
+
−        ip+= packet->buffer[pos + 3];/*lint !e662 !e661 possible creation and access of out-of-bounds pointer*/
+
−        ip = ip << 8;
+
−        ip+= packet->buffer[pos + 4];/*lint !e662 !e661 possible creation and access of out-of-bounds pointer*/
+
−        ip = ip << 8;
+
−        ip+= packet->buffer[pos + 5];/*lint !e662 !e661 possible creation and access of out-of-bounds pointer*/
+
−
+
−        if(type_len EQ LENGTH_IP)
+
−        {
+
−          ppp_data->ncp.s_rejected &= ~(1UL << MASK_TYPE_IP);
+
−          if(ppp_data->mode EQ PPP_CLIENT)
+
−            ppp_data->ncp.n_ip = ip;
+
−          else if(ppp_data->ncp.req_gateway EQ PPP_GATEWAY_DEFAULT)
+
−            ppp_data->ncp.n_gateway = ip;
+
−        }
+
−        break;
+
−      case TYPE_PDNS:
+
−        pdns = packet->buffer[pos + 2];/*lint !e662 !e661 possible creation and access of out-of-bounds pointer*/
+
−        pdns = pdns << 8;
+
−        pdns+= packet->buffer[pos + 3];/*lint !e662 !e661 possible creation and access of out-of-bounds pointer*/
+
−        pdns = pdns << 8;
+
−        pdns+= packet->buffer[pos + 4];/*lint !e662 !e661 possible creation and access of out-of-bounds pointer*/
+
−        pdns = pdns << 8;
+
−        pdns+= packet->buffer[pos + 5];/*lint !e662 !e661 possible creation and access of out-of-bounds pointer*/
+
−
+
−        if((type_len EQ LENGTH_PDNS) &&
+
−           (ppp_data->mode EQ PPP_CLIENT))
+
−        {
+
−          ppp_data->ncp.s_rejected &= ~(1UL << MASK_TYPE_PDNS);
+
−          ppp_data->ncp.n_pdns = pdns;
+
−        }
+
−        break;
+
−      case TYPE_SDNS:
+
−        sdns = packet->buffer[pos + 2];/*lint !e662 !e661 possible creation and access of out-of-bounds pointer*/
+
−        sdns = sdns << 8;
+
−        sdns+= packet->buffer[pos + 3];/*lint !e662 !e661 possible creation and access of out-of-bounds pointer*/
+
−        sdns = sdns << 8;
+
−        sdns+= packet->buffer[pos + 4];/*lint !e662 !e661 possible creation and access of out-of-bounds pointer*/
+
−        sdns = sdns << 8;
+
−        sdns+= packet->buffer[pos + 5];/*lint !e662 !e661 possible creation and access of out-of-bounds pointer*/
+
−
+
−        if((type_len EQ LENGTH_SDNS) &&
+
−           (ppp_data->mode EQ PPP_CLIENT))
+
−        {
+
−          ppp_data->ncp.s_rejected &= ~(1UL << MASK_TYPE_SDNS);
+
−          ppp_data->ncp.n_sdns = sdns;
+
−        }
+
−        break;
+
−      default:
+
−        /*
+
−         * ignore unknown configuration options
+
−         */
+
−        break;
+
−    }
+
−    pos+= type_len;
+
−  }
+
−  /*
+
−   * free this packet and create a new with changed configuration options
+
−   */
+
−  arb_discard_packet(packet);
+
−  *forward=FORWARD_RCN;
+
−  ppp_data->ncp.nscri++;
+
−  ncp_get_scr(&packet);
+
−  *ptr_packet=packet;
+
−} /* ncp_rcn() */
+
−
+
−
+
−
+
−/*
+
−+------------------------------------------------------------------------------
+
−| Function    : ncp_rcj
+
−+------------------------------------------------------------------------------
+
−| Description : The function ncp_rcj() analyze the given
+
−|               Configure Reject packet, marks some values as rejected and
+
−|               returns FORWARD_RCJ
+
−|               The packet pointer points to an appropriate response packet.
+
−|
+
−| Parameters  : ptr_packet  - pointer to a Configure Reject packet
+
−|               forward     - returns result of analysis
+
−|
+
−+------------------------------------------------------------------------------
+
−*/
+
−GLOBAL void ncp_rcj (T_desc2** ptr_packet, UBYTE* forward)
+
−{
+
−  T_desc2* packet;
+
−  USHORT   packet_len;
+
−  UBYTE    type_len;
+
−  USHORT   pos;
+
−
+
−  TRACE_FUNCTION( "ncp_rcj" );
+
−
+
−  /*
+
−   * check for correct length field
+
−   */
+
−  packet = *ptr_packet;
+
−  packet_len = packet->buffer[2];/*lint !e415 !e416 creation and access of out-of-bounds pointer */
+
−  packet_len <<= 8;
+
−  packet_len+= packet->buffer[3];/*lint !e415 !e416 creation and access of out-of-bounds pointer */
+
−  if((packet_len > packet->len) ||
+
−     (packet_len < 4) ||
+
−     (ppp_data->ncp.scr EQ FALSE) ||
+
−     (packet->buffer[1] NEQ ppp_data->ncp.nscri))/*lint !e415 access of out-of-bounds pointer */
+
−  {
+
−    /*
+
−     * invalid packet
+
−     */
+
−    *forward=FORWARD_DISCARD;
+
−    return;
+
−  }
+
−  /*
+
−   * check consistence of length of packet and length of configuration options
+
−   */
+
−  pos=5;
+
−  while(pos < packet_len)
+
−  {
+
−    if(packet->buffer[pos] < 2)/*lint !e662 !e661 possible creation and access of out-of-bounds pointer*/
+
−    {
+
−      *forward=FORWARD_DISCARD;
+
−      return;
+
−    }
+
−    pos+= packet->buffer[pos];/*lint !e662 !e661 possible creation and access of out-of-bounds pointer*/
+
−  }
+
−  if((pos - 1) NEQ packet_len)
+
−  {
+
−    *forward=FORWARD_DISCARD;
+
−    return;
+
−  }
+
−  /*
+
−   * analyze configuration options
+
−   */
+
−  pos=4;
+
−  while(pos < packet_len)
+
−  {
+
−    type_len=packet->buffer[pos + 1];/*lint !e662 !e661 possible creation and access of out-of-bounds pointer*/
+
−    switch(packet->buffer[pos])/*lint !e662 !e661 possible creation and access of out-of-bounds pointer*/
+
−    {
+
−      /*
+
−       * yet supported configuration options
+
−       */
+
−      case TYPE_HC:
+
−        ppp_data->ncp.s_rejected|= (1UL << MASK_TYPE_HC);
+
−        ppp_data->ncp.s_hc = PPP_HC_DEFAULT;
+
−        break;
+
−      case TYPE_IP:
+
−        if (ppp_data->mode EQ PPP_CLIENT)
+
−        { /* error: server has to support valid IP address */
+
−          *forward=FORWARD_DISCARD;
+
−          return;
+
−        }
+
−        ppp_data->ncp.s_rejected |= (1UL << MASK_TYPE_IP);
+
−        break;
+
−      case TYPE_PDNS:
+
−        ppp_data->ncp.s_rejected |= (1UL << MASK_TYPE_PDNS);
+
−        break;
+
−      case TYPE_SDNS:
+
−        ppp_data->ncp.s_rejected |= (1UL << MASK_TYPE_SDNS);
+
−        break;
+
−      default:
+
−        /*
+
−         * ignore unknown configuration options
+
−         */
+
−        break;
+
−    }
+
−    pos+= type_len;
+
−  }
+
−  /*
+
−   * free this packet and create a new with changed configuration options
+
−   */
+
−  arb_discard_packet(packet);
+
−  *forward=FORWARD_RCN;
+
−  ppp_data->ncp.nscri++;
+
−  ncp_get_scr(&packet);
+
−  *ptr_packet=packet;
+
−} /* ncp_rcj() */
+
−
+
−
+
−
+
−/*
+
−+------------------------------------------------------------------------------
+
−| Function    : ncp_rtr
+
−+------------------------------------------------------------------------------
+
−| Description : The function ncp_rtr() checks whether the given
+
−|               Terminate Request packet is valid and if so it returns
+
−|               FORWARD_RCA. Otherwise it returns FORWARD_DISCARD.
+
−|
+
−| Parameters  : ptr_packet - pointer to a Terminate Request packet
+
−|               forward    - returns result of analysis
+
−|
+
−+------------------------------------------------------------------------------
+
−*/
+
−GLOBAL void ncp_rtr (T_desc2** ptr_packet, UBYTE* forward)
+
−{
+
−  T_desc2* packet;
+
−  USHORT   packet_len;
+
−
+
−  TRACE_FUNCTION( "ncp_rtr" );
+
−
+
−  /*
+
−   * check for correct length field
+
−   */
+
−  packet = *ptr_packet;
+
−  packet_len = packet->buffer[2];/*lint !e415 !e416 creation and access of out-of-bounds pointer */
+
−  packet_len <<= 8;
+
−  packet_len+= packet->buffer[3];/*lint !e415 !e416 creation and access of out-of-bounds pointer */
+
−  if((packet_len < 4) || (packet_len > packet->len))
+
−  {
+
−    *forward=FORWARD_DISCARD;
+
−    return;
+
−  }
+
−
+
−  /*
+
−   * change code field
+
−   */
+
−  packet->buffer[0]=CODE_TERM_ACK;
+
−
+
−  *forward=FORWARD_RTR;
+
−} /* ncp_rtr() */
+
−
+
−
+
−
+
−/*
+
−+------------------------------------------------------------------------------
+
−| Function    : ncp_rta
+
−+------------------------------------------------------------------------------
+
−| Description : The function ncp_rta() checks whether the given
+
−|               Terminate Ack packet is valid and if so it returns
+
−|               FORWARD_RTA. Otherwise it returns FORWARD_DISCARD.
+
−|
+
−| Parameters  : packet  - Terminate Ack packet
+
−|               forward - returns result of analysis
+
−|
+
−+------------------------------------------------------------------------------
+
−*/
+
−GLOBAL void ncp_rta (T_desc2* packet, UBYTE* forward)
+
−{
+
−  USHORT  packet_len;
+
−
+
−  TRACE_FUNCTION( "ncp_rta" );
+
−
+
−  /*
+
−   * check for correct length field
+
−   */
+
−  packet_len = packet->buffer[2];/*lint !e415 !e416 creation and access of out-of-bounds pointer */
+
−  packet_len <<= 8;
+
−  packet_len+= packet->buffer[3];/*lint !e415 !e416 creation and access of out-of-bounds pointer */
+
−  if((packet_len < 4) || (packet_len > packet->len))
+
−  {
+
−    *forward=FORWARD_DISCARD;
+
−    return;
+
−  }
+
−
+
−  if((ppp_data->ncp.str EQ TRUE) &&
+
−     (packet->buffer[1] NEQ ppp_data->ncp.nstri))/*lint !e415 access of out-of-bounds pointer */
+
−  {
+
−    /*
+
−     * invalid packet
+
−     */
+
−    *forward=FORWARD_DISCARD;
+
−    return;
+
−  }
+
−  /*
+
−   * acceptable packet
+
−   */
+
−  arb_discard_packet(packet);
+
−  ppp_data->ncp.nstri++;
+
−  *forward=FORWARD_RTA;
+
−} /* ncp_rta() */
+
−
+
−
+
−
+
−/*
+
−+------------------------------------------------------------------------------
+
−| Function    : ncp_rxj
+
−+------------------------------------------------------------------------------
+
−| Description : The function ncp_rxj() analyzes whether the given Code Reject
+
−|               is acceptable. If not it returns FORWARD_RXJN.
+
−|
+
−| Parameters  : ptr_packet - Pointer to a Code Reject packet
+
−|               forward    - returns result of analysis
+
−|
+
−+------------------------------------------------------------------------------
+
−*/
+
−GLOBAL void ncp_rxj (T_desc2** ptr_packet, UBYTE* forward)
+
−{
+
−  USHORT  packet_len;
+
−  T_desc2* packet;
+
−
+
−  TRACE_FUNCTION( "ncp_rxj" );
+
−
+
−  /*
+
−   * check for correct length field
+
−   */
+
−  packet = *ptr_packet;
+
−  packet_len = packet->buffer[2];/*lint !e415 !e416 creation and access of out-of-bounds pointer */
+
−  packet_len <<= 8;
+
−  packet_len+= packet->buffer[3];/*lint !e415 !e416 creation and access of out-of-bounds pointer */
+
−  if((packet_len < 5) || (packet_len > packet->len))
+
−  {
+
−    *forward=FORWARD_DISCARD;
+
−    return;
+
−  }
+
−
+
−  switch(packet->buffer[4])/*lint !e415 !e416 creation and access of out-of-bounds pointer */
+
−  {
+
−    case CODE_CONF_REQ:
+
−    case CODE_CONF_REJ:
+
−    case CODE_CONF_NAK:
+
−    case CODE_CONF_ACK:
+
−    case CODE_TERM_REQ:
+
−    case CODE_TERM_ACK:
+
−    case CODE_CODE_REJ:
+
−      arb_discard_packet(packet);
+
−      ncp_get_str(&packet);
+
−      *ptr_packet = packet;
+
−      *forward = FORWARD_RXJN;
+
−      break;
+
−    default:
+
−      *forward=FORWARD_DISCARD;
+
−      break;
+
−  }
+
−} /* ncp_rxj() */
+
−
+
−
+
−
+
−/*
+
−+------------------------------------------------------------------------------
+
−| Function    : ncp_ruc
+
−+------------------------------------------------------------------------------
+
−| Description : The function ncp_ruc() creates a Code Reject packet and returns
+
−|               FORWARD_RUC.
+
−|
+
−| Parameters  : ptr_packet - packet with unknown code
+
−|               forward    - returns result of analysis
+
−|
+
−+------------------------------------------------------------------------------
+
−*/
+
−GLOBAL void ncp_ruc (T_desc2** ptr_packet, UBYTE* forward)
+
−{
+
−  T_desc2* packet;
+
−  T_desc2* temp_desc;
+
−  USHORT  packet_len;
+
−
+
−  TRACE_FUNCTION( "ncp_ruc" );
+
−
+
−  /*
+
−   * check for correct length field
+
−   */
+
−  packet = *ptr_packet;
+
−  packet_len = packet->buffer[2];/*lint !e415 !e416 creation and access of out-of-bounds pointer */
+
−  packet_len <<= 8;
+
−  packet_len+= packet->buffer[3];/*lint !e415 !e416 creation and access of out-of-bounds pointer */
+
−  if((packet->len < packet_len) || (packet_len < 4))
+
−  {
+
−    *forward=FORWARD_DISCARD;
+
−    return;
+
−  }
+
−
+
−  /*
+
−   * create a new larger packet and copy the content
+
−   * of the old packet into the new
+
−   */
+
−  packet_len+=4;
+
−  if(packet_len > PPP_MRU_MIN)
+
−    packet_len = PPP_MRU_MIN;
+
−  MALLOC (temp_desc, (USHORT)(sizeof(T_desc2) - 1 + packet_len));
+
−
+
−  temp_desc->next = packet->next;
+
−  temp_desc->len  = packet_len;
+
−  memcpy(&temp_desc->buffer[4], packet->buffer, packet_len - 4);/*lint !e416 !e669 !e670 creation of out-of-bounds pointer */
+
−  arb_discard_packet(packet);
+
−  packet = temp_desc;
+
−
+
−  /*
+
−   * fill the first bytes to create a Code Reject
+
−   */
+
−  packet->buffer[0] = CODE_CODE_REJ;
+
−  ppp_data->ncp.nscji++;
+
−  packet->buffer[1] = ppp_data->ncp.nscji;/*lint !e415 access of out-of-bounds pointer */
+
−  packet->buffer[2] = (UBYTE)(packet_len >> 8);/*lint !e415 !e416 creation and access of out-of-bounds pointer */
+
−  packet->buffer[3] = (UBYTE)(packet_len & 0x00ff);/*lint !e415 !e416 creation and access of out-of-bounds pointer */
+
−
+
−  /*
+
−   * set return values
+
−   */
+
−  *ptr_packet=packet;
+
−  *forward=FORWARD_RUC;
+
−
+
−} /* ncp_ruc() */