summaryrefslogtreecommitdiffstats
path: root/drivers/net/ppp
diff options
context:
space:
mode:
authorFlorian Westphal <fw@strlen.de>2015-01-28 10:56:04 +0100
committerDavid S. Miller <davem@davemloft.net>2015-01-29 14:50:01 -0800
commite2a4800e75780ccf4e6c2487f82b688ba736eb18 (patch)
tree24ae0d44cd90ce184165ff63fccc17782b755083 /drivers/net/ppp
parentd445d63b77577f7ecdd7eb7e9d6518493cdcd778 (diff)
downloadlinux-e2a4800e75780ccf4e6c2487f82b688ba736eb18.tar.bz2
ppp: deflate: never return len larger than output buffer
When we've run out of space in the output buffer to store more data, we will call zlib_deflate with a NULL output buffer until we've consumed remaining input. When this happens, olen contains the size the output buffer would have consumed iff we'd have had enough room. This can later cause skb_over_panic when ppp_generic skb_put()s the returned length. Reported-by: Iain Douglas <centos@1n6.org.uk> Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'drivers/net/ppp')
-rw-r--r--drivers/net/ppp/ppp_deflate.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/net/ppp/ppp_deflate.c b/drivers/net/ppp/ppp_deflate.c
index 602c625d95d5..b5edc7f96a39 100644
--- a/drivers/net/ppp/ppp_deflate.c
+++ b/drivers/net/ppp/ppp_deflate.c
@@ -246,7 +246,7 @@ static int z_compress(void *arg, unsigned char *rptr, unsigned char *obuf,
/*
* See if we managed to reduce the size of the packet.
*/
- if (olen < isize) {
+ if (olen < isize && olen <= osize) {
state->stats.comp_bytes += olen;
state->stats.comp_packets++;
} else {