diff options
| author | Konstantin Sharlaimov <konstantin.sharlaimov@gmail.com> | 2007-09-25 01:01:54 +0400 |
|---|---|---|
| committer | Adrian Bunk <bunk@stusta.de> | 2007-09-25 01:01:54 +0400 |
| commit | 44315cc76567e2d911d56091665637e305af182d (patch) | |
| tree | 55ba5ebe14885eda9e4c5b5406b4e8f0dc5ecb7b | |
| parent | 648409668700fb5cc3a9454b042952a996c53c8b (diff) | |
| download | linux-44315cc76567e2d911d56091665637e305af182d.tar.xz | |
[PPP]: Fix osize too small errors when decoding mppe.
The mppe_decompress() function required a buffer that is 1 byte too
small when receiving a message of mru size. This fixes buffer
allocation to prevent this from occurring.
Signed-off-by: Konstantin Sharlaimov <konstantin.sharlaimov@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Adrian Bunk <bunk@kernel.org>
| -rw-r--r-- | drivers/net/ppp_generic.c | 13 |
1 files changed, 12 insertions, 1 deletions
diff --git a/drivers/net/ppp_generic.c b/drivers/net/ppp_generic.c index e37648c256fc..802f249b87c8 100644 --- a/drivers/net/ppp_generic.c +++ b/drivers/net/ppp_generic.c @@ -1721,7 +1721,18 @@ ppp_decompress_frame(struct ppp *ppp, struct sk_buff *skb) goto err; if (proto == PPP_COMP) { - ns = dev_alloc_skb(ppp->mru + PPP_HDRLEN); + int obuff_size; + + switch(ppp->rcomp->compress_proto) { + case CI_MPPE: + obuff_size = ppp->mru + PPP_HDRLEN + 1; + break; + default: + obuff_size = ppp->mru + PPP_HDRLEN; + break; + } + + ns = dev_alloc_skb(obuff_size); if (ns == 0) { printk(KERN_ERR "ppp_decompress_frame: no memory\n"); goto err; |