]> git.baikalelectronics.ru Git - kernel.git/commit
ppp: deflate: never return len larger than output buffer
authorFlorian Westphal <fw@strlen.de>
Wed, 28 Jan 2015 09:56:04 +0000 (10:56 +0100)
committerDavid S. Miller <davem@davemloft.net>
Thu, 29 Jan 2015 22:50:01 +0000 (14:50 -0800)
commit543c0131edcd327b5a456f7cec5938bd4813cf7c
tree24ae0d44cd90ce184165ff63fccc17782b755083
parentd7ce143114be4736d2ee1011d7420fe0a5fe712c
ppp: deflate: never return len larger than output buffer

When we've run out of space in the output buffer to store more data, we
will call zlib_deflate with a NULL output buffer until we've consumed
remaining input.

When this happens, olen contains the size the output buffer would have
consumed iff we'd have had enough room.

This can later cause skb_over_panic when ppp_generic skb_put()s
the returned length.

Reported-by: Iain Douglas <centos@1n6.org.uk>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
drivers/net/ppp/ppp_deflate.c