[PPP]: Fix osize too small errors when decoding mppe.
The mppe_decompress() function required a buffer that is 1 byte too small when receiving a message of mru size. This fixes buffer allocation to prevent this from occurring. Signed-off-by: Konstantin Sharlaimov <konstantin.sharlaimov@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
parent
7e4a6da7c2
commit
4b2a8fb3a7
|
@ -1708,7 +1708,18 @@ ppp_decompress_frame(struct ppp *ppp, struct sk_buff *skb)
|
|||
goto err;
|
||||
|
||||
if (proto == PPP_COMP) {
|
||||
ns = dev_alloc_skb(ppp->mru + PPP_HDRLEN);
|
||||
int obuff_size;
|
||||
|
||||
switch(ppp->rcomp->compress_proto) {
|
||||
case CI_MPPE:
|
||||
obuff_size = ppp->mru + PPP_HDRLEN + 1;
|
||||
break;
|
||||
default:
|
||||
obuff_size = ppp->mru + PPP_HDRLEN;
|
||||
break;
|
||||
}
|
||||
|
||||
ns = dev_alloc_skb(obuff_size);
|
||||
if (ns == 0) {
|
||||
printk(KERN_ERR "ppp_decompress_frame: no memory\n");
|
||||
goto err;
|
||||
|
|
Loading…
Reference in New Issue