aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorKonstantin Sharlaimov <konstantin.sharlaimov@gmail.com>2007-09-24 23:01:54 +0200
committerAdrian Bunk <bunk@stusta.de>2007-09-24 23:01:54 +0200
commit44315cc76567e2d911d56091665637e305af182d (patch)
tree55ba5ebe14885eda9e4c5b5406b4e8f0dc5ecb7b
parent648409668700fb5cc3a9454b042952a996c53c8b (diff)
downloadlinux-linaro-stable-44315cc76567e2d911d56091665637e305af182d.tar.gz
[PPP]: Fix osize too small errors when decoding mppe.
The mppe_decompress() function required a buffer that is 1 byte too small when receiving a message of mru size. This fixes buffer allocation to prevent this from occurring. Signed-off-by: Konstantin Sharlaimov <konstantin.sharlaimov@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Adrian Bunk <bunk@kernel.org>
-rw-r--r--drivers/net/ppp_generic.c13
1 files changed, 12 insertions, 1 deletions
diff --git a/drivers/net/ppp_generic.c b/drivers/net/ppp_generic.c
index e37648c256fc..802f249b87c8 100644
--- a/drivers/net/ppp_generic.c
+++ b/drivers/net/ppp_generic.c
@@ -1721,7 +1721,18 @@ ppp_decompress_frame(struct ppp *ppp, struct sk_buff *skb)
goto err;
if (proto == PPP_COMP) {
- ns = dev_alloc_skb(ppp->mru + PPP_HDRLEN);
+ int obuff_size;
+
+ switch(ppp->rcomp->compress_proto) {
+ case CI_MPPE:
+ obuff_size = ppp->mru + PPP_HDRLEN + 1;
+ break;
+ default:
+ obuff_size = ppp->mru + PPP_HDRLEN;
+ break;
+ }
+
+ ns = dev_alloc_skb(obuff_size);
if (ns == 0) {
printk(KERN_ERR "ppp_decompress_frame: no memory\n");
goto err;