kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-18 19:12:56 +00:00
Code Issues Releases Packages Activity
linux/drivers/net/ppp
History
Ben Hutchings 9bd814beb4 ppp, slip: Validate VJ compression slot parameters completely 
commit 4ab42d78e3 upstream.

Currently slhc_init() treats out-of-range values of rslots and tslots
as equivalent to 0, except that if tslots is too large it will
dereference a null pointer (CVE-2015-7799).

Add a range-check at the top of the function and make it return an
ERR_PTR() on error instead of NULL.  Change the callers accordingly.

Compile-tested only.

Reported-by: 郭永刚 <guoyonggang@360.cn>
References: http://article.gmane.org/gmane.comp.security.oss.general/17908
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Signed-off-by: David S. Miller <davem@davemloft.net>
Cc: Moritz Mühlenhoff <jmm@inutil.org>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
History 2015-11-16 11:27:22 +00:00
..
bsd_comp.c ppp: Move the PPP drivers 2011-08-27 00:58:26 -07:00
Kconfig tty/serial patches for 3.9-rc1 2013-02-21 13:41:04 -08:00
Makefile ppp: Move the PPP drivers 2011-08-27 00:58:26 -07:00
ppp_async.c tty: Fix recursive deadlock in tty_perform_flush() 2013-03-18 16:52:24 -07:00
ppp_deflate.c ppp: deflate: never return len larger than output buffer 2015-02-10 13:38:50 +00:00
ppp_generic.c ppp, slip: Validate VJ compression slot parameters completely 2015-11-16 11:27:22 +00:00
ppp_mppe.c drivers/net/*: Fix FSF address in file headers 2013-12-06 12:37:55 -05:00
ppp_mppe.h ppp: Move the PPP drivers 2011-08-27 00:58:26 -07:00
ppp_synctty.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next 2013-05-01 14:08:52 -07:00
pppoe.c ppp: fix pppoe_dev deletion condition in pppoe_release() 2015-11-16 11:27:18 +00:00
pppox.c ppp: Replace uses of <linux/if_ppp.h> with <linux/ppp-ioctl.h> 2012-03-04 20:41:38 -05:00
pptp.c pptp: fix stack info leak in pptp_getname() 2014-12-01 10:02:10 +00:00