summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorKonstantin Sharlaimov <konstantin.sharlaimov@gmail.com>2007-06-23 23:05:54 -0700
committerDavid S. Miller <davem@davemloft.net>2007-06-23 23:05:54 -0700
commit4b2a8fb3a7f7935f62a7bbdc851789fb7c2da032 (patch)
tree73481354594bdab8a9208619ac9dd3f1ce47f424
parent7e4a6da7c2a1e0df06b71dc4ddc31910229ba9d9 (diff)
[PPP]: Fix osize too small errors when decoding mppe.
The mppe_decompress() function required a buffer that is 1 byte too small when receiving a message of mru size. This fixes buffer allocation to prevent this from occurring. Signed-off-by: Konstantin Sharlaimov <konstantin.sharlaimov@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
-rw-r--r--drivers/net/ppp_generic.c13
1 files changed, 12 insertions, 1 deletions
diff --git a/drivers/net/ppp_generic.c b/drivers/net/ppp_generic.c
index 541168713f1f..3ef0092dc09c 100644
--- a/drivers/net/ppp_generic.c
+++ b/drivers/net/ppp_generic.c
@@ -1708,7 +1708,18 @@ ppp_decompress_frame(struct ppp *ppp, struct sk_buff *skb)
goto err;
if (proto == PPP_COMP) {
- ns = dev_alloc_skb(ppp->mru + PPP_HDRLEN);
+ int obuff_size;
+
+ switch(ppp->rcomp->compress_proto) {
+ case CI_MPPE:
+ obuff_size = ppp->mru + PPP_HDRLEN + 1;
+ break;
+ default:
+ obuff_size = ppp->mru + PPP_HDRLEN;
+ break;
+ }
+
+ ns = dev_alloc_skb(obuff_size);
if (ns == 0) {
printk(KERN_ERR "ppp_decompress_frame: no memory\n");
goto err;