[PPP]: Fix osize too small errors when decoding mppe.

The mppe_decompress() function required a buffer that is 1 byte too
small when receiving a message of mru size. This fixes buffer
allocation to prevent this from occurring.

Signed-off-by: Konstantin Sharlaimov <konstantin.sharlaimov@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

authored by Konstantin Sharlaimov and committed by David S. Miller 4b2a8fb3 7e4a6da7

+12 -1
+12 -1
drivers/net/ppp_generic.c
··· 1708 goto err; 1709 1710 if (proto == PPP_COMP) { 1711 - ns = dev_alloc_skb(ppp->mru + PPP_HDRLEN); 1712 if (ns == 0) { 1713 printk(KERN_ERR "ppp_decompress_frame: no memory\n"); 1714 goto err;
··· 1708 goto err; 1709 1710 if (proto == PPP_COMP) { 1711 + int obuff_size; 1712 + 1713 + switch(ppp->rcomp->compress_proto) { 1714 + case CI_MPPE: 1715 + obuff_size = ppp->mru + PPP_HDRLEN + 1; 1716 + break; 1717 + default: 1718 + obuff_size = ppp->mru + PPP_HDRLEN; 1719 + break; 1720 + } 1721 + 1722 + ns = dev_alloc_skb(obuff_size); 1723 if (ns == 0) { 1724 printk(KERN_ERR "ppp_decompress_frame: no memory\n"); 1725 goto err;