linux-hardened/drivers/net/ppp
Florian Westphal e2a4800e75 ppp: deflate: never return len larger than output buffer
When we've run out of space in the output buffer to store more data, we
will call zlib_deflate with a NULL output buffer until we've consumed
remaining input.

When this happens, olen contains the size the output buffer would have
consumed iff we'd have had enough room.

This can later cause skb_over_panic when ppp_generic skb_put()s
the returned length.

Reported-by: Iain Douglas <centos@1n6.org.uk>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
2015-01-29 14:50:01 -08:00
..
bsd_comp.c
Kconfig tty/serial patches for 3.9-rc1 2013-02-21 13:41:04 -08:00
Makefile
ppp_async.c tty: Fix recursive deadlock in tty_perform_flush() 2013-03-18 16:52:24 -07:00
ppp_deflate.c ppp: deflate: never return len larger than output buffer 2015-01-29 14:50:01 -08:00
ppp_generic.c ppp_read(): switch to skb_copy_datagram_iter() 2014-12-09 16:29:10 -05:00
ppp_mppe.c drivers/net/*: Fix FSF address in file headers 2013-12-06 12:37:55 -05:00
ppp_mppe.h
ppp_synctty.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next 2013-05-01 14:08:52 -07:00
pppoe.c new helper: memcpy_from_msg() 2014-11-24 04:28:48 -05:00
pppox.c ppp: Replace uses of <linux/if_ppp.h> with <linux/ppp-ioctl.h> 2012-03-04 20:41:38 -05:00
pptp.c pptp: fix stack info leak in pptp_getname() 2014-11-20 22:43:47 -05:00