提交 4b2a8fb3 编写于 作者: K Konstantin Sharlaimov 提交者: David S. Miller

[PPP]: Fix osize too small errors when decoding mppe.

The mppe_decompress() function required a buffer that is 1 byte too
small when receiving a message of mru size. This fixes buffer
allocation to prevent this from occurring.
Signed-off-by: NKonstantin Sharlaimov <konstantin.sharlaimov@gmail.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>
上级 7e4a6da7
...@@ -1708,7 +1708,18 @@ ppp_decompress_frame(struct ppp *ppp, struct sk_buff *skb) ...@@ -1708,7 +1708,18 @@ ppp_decompress_frame(struct ppp *ppp, struct sk_buff *skb)
goto err; goto err;
if (proto == PPP_COMP) { if (proto == PPP_COMP) {
ns = dev_alloc_skb(ppp->mru + PPP_HDRLEN); int obuff_size;
switch(ppp->rcomp->compress_proto) {
case CI_MPPE:
obuff_size = ppp->mru + PPP_HDRLEN + 1;
break;
default:
obuff_size = ppp->mru + PPP_HDRLEN;
break;
}
ns = dev_alloc_skb(obuff_size);
if (ns == 0) { if (ns == 0) {
printk(KERN_ERR "ppp_decompress_frame: no memory\n"); printk(KERN_ERR "ppp_decompress_frame: no memory\n");
goto err; goto err;
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册