]> git.baikalelectronics.ru Git - kernel.git/commit
ppp: deflate: never return len larger than output buffer
authorFlorian Westphal <fw@strlen.de>
Wed, 28 Jan 2015 09:56:04 +0000 (10:56 +0100)
committerDavid S. Miller <davem@davemloft.net>
Thu, 29 Jan 2015 22:50:01 +0000 (14:50 -0800)
commita568e87054a7998b777ec661c22b41fb89f4c76d
tree24ae0d44cd90ce184165ff63fccc17782b755083
parentfd2c4c0f002c740ac9877b6cca132724e9ff1e66
ppp: deflate: never return len larger than output buffer

When we've run out of space in the output buffer to store more data, we
will call zlib_deflate with a NULL output buffer until we've consumed
remaining input.

When this happens, olen contains the size the output buffer would have
consumed iff we'd have had enough room.

This can later cause skb_over_panic when ppp_generic skb_put()s
the returned length.

Reported-by: Iain Douglas <centos@1n6.org.uk>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
drivers/net/ppp/ppp_deflate.c