]> git.hungrycats.org Git - linux/commit
ppp: deflate: never return len larger than output buffer
authorFlorian Westphal <fw@strlen.de>
Wed, 28 Jan 2015 09:56:04 +0000 (10:56 +0100)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Fri, 27 Feb 2015 01:49:01 +0000 (17:49 -0800)
commit15f7f69a6baccddc90f6cc313ebc4b04cc75829a
tree029364d4b2706ee25874618a057224b7b028e12d
parentb974d00b778962b9b83c477a7359e40a28f7ed98
ppp: deflate: never return len larger than output buffer

[ Upstream commit e2a4800e75780ccf4e6c2487f82b688ba736eb18 ]

When we've run out of space in the output buffer to store more data, we
will call zlib_deflate with a NULL output buffer until we've consumed
remaining input.

When this happens, olen contains the size the output buffer would have
consumed iff we'd have had enough room.

This can later cause skb_over_panic when ppp_generic skb_put()s
the returned length.

Reported-by: Iain Douglas <centos@1n6.org.uk>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/net/ppp/ppp_deflate.c