kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-26 19:14:18 +00:00
Code Issues Releases Packages Activity
linux/drivers/net/ppp
History
Ben Hutchings 82185755d9 ppp, slip: Validate VJ compression slot parameters completely 
[ Upstream commit 4ab42d78e3 ]

Currently slhc_init() treats out-of-range values of rslots and tslots
as equivalent to 0, except that if tslots is too large it will
dereference a null pointer (CVE-2015-7799).

Add a range-check at the top of the function and make it return an
ERR_PTR() on error instead of NULL.  Change the callers accordingly.

Compile-tested only.

Reported-by: 郭永刚 <guoyonggang@360.cn>
References: http://article.gmane.org/gmane.comp.security.oss.general/17908
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
History 2016-02-15 15:42:45 -05:00
..
bsd_comp.c ppp: Move the PPP drivers 2011-08-27 00:58:26 -07:00
Kconfig tty/serial patches for 3.9-rc1 2013-02-21 13:41:04 -08:00
Makefile ppp: Move the PPP drivers 2011-08-27 00:58:26 -07:00
ppp_async.c tty: Fix recursive deadlock in tty_perform_flush() 2013-03-18 16:52:24 -07:00
ppp_deflate.c ppp: deflate: never return len larger than output buffer 2015-02-26 17:49:01 -08:00
ppp_generic.c ppp, slip: Validate VJ compression slot parameters completely 2016-02-15 15:42:45 -05:00
ppp_mppe.c drivers/net/*: Fix FSF address in file headers 2013-12-06 12:37:55 -05:00
ppp_mppe.h ppp: Move the PPP drivers 2011-08-27 00:58:26 -07:00
ppp_synctty.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next 2013-05-01 14:08:52 -07:00
pppoe.c ppp: fix pppoe_dev deletion condition in pppoe_release() 2015-12-03 10:11:30 -05:00
pppox.c ppp: Replace uses of <linux/if_ppp.h> with <linux/ppp-ioctl.h> 2012-03-04 20:41:38 -05:00
pptp.c pptp: verify sockaddr_len in pptp_bind() and pptp_connect() 2016-01-15 18:41:51 -05:00