diff options
| author | Daniel Baumann <daniel.baumann@progress-linux.org> | 2024-05-08 04:21:42 +0000 |
|---|---|---|
| committer | Daniel Baumann <daniel.baumann@progress-linux.org> | 2024-05-08 04:21:42 +0000 |
| commit | 9d537f04b26ad3ac10399b4885f6dcd9112f7973 (patch) | |
| tree | 734b519d1bca2065d28c33bce394def4d50c4da5 /drivers/net/ppp | |
| parent | Releasing progress-linux version 4.19.289-2progress5u1. (diff) | |
| download | linux-9d537f04b26ad3ac10399b4885f6dcd9112f7973.tar.xz linux-9d537f04b26ad3ac10399b4885f6dcd9112f7973.zip | |
Merging upstream version 4.19.304.
Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>
Diffstat (limited to 'drivers/net/ppp')
| -rw-r--r-- | drivers/net/ppp/ppp_synctty.c | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/drivers/net/ppp/ppp_synctty.c b/drivers/net/ppp/ppp_synctty.c index 047f6c68a..7a1b903d3 100644 --- a/drivers/net/ppp/ppp_synctty.c +++ b/drivers/net/ppp/ppp_synctty.c @@ -467,6 +467,10 @@ ppp_sync_ioctl(struct ppp_channel *chan, unsigned int cmd, unsigned long arg) case PPPIOCSMRU: if (get_user(val, (int __user *) argp)) break; + if (val > U16_MAX) { + err = -EINVAL; + break; + } if (val < PPP_MRU) val = PPP_MRU; ap->mru = val; @@ -702,7 +706,7 @@ ppp_sync_input(struct syncppp *ap, const unsigned char *buf, /* strip address/control field if present */ p = skb->data; - if (p[0] == PPP_ALLSTATIONS && p[1] == PPP_UI) { + if (skb->len >= 2 && p[0] == PPP_ALLSTATIONS && p[1] == PPP_UI) { /* chop off address/control */ if (skb->len < 3) goto err; |