Update this for the new CHAP code. Untested.

[ppp.git] / linux / mppe / ppp_mppe_compress.c

diff --git a/linux/mppe/ppp_mppe_compress.c b/linux/mppe/ppp_mppe_compress.c
index 0a757686de4ce1c83c23b9f78c8f8154b5ad4a3d..33885df433211f92c433a65ef0548a30469b98e3 100644 (file)
--- a/linux/mppe/ppp_mppe_compress.c
+++ b/linux/mppe/ppp_mppe_compress.c
@@ -333,6 +333,9 @@ mppe_compress(void *arg, unsigned char *ibuf, unsigned char *obuf,
     obuf += PPP_HDRLEN;
 
     state->ccount = (state->ccount + 1) % MPPE_CCOUNT_SPACE;
+    if (state->debug >= 7)
+       printk(KERN_DEBUG "mppe_compress[%d]: ccount %d\n", state->unit,
+              state->ccount);
     obuf[0] = state->ccount >> 8;
     obuf[1] = state->ccount & 0xff;
 
@@ -412,12 +415,20 @@ mppe_decompress(void *arg, unsigned char *ibuf, int isize, unsigned char *obuf,
                   state->unit, isize);
        return DECOMP_ERROR;
     }
-    /* Strange ... our output size is always LESS than the input size. */
-    /* assert(osize >= isize - MPPE_OVHD - 2); */
 
+    /* Make sure we have enough room to decrypt the packet. */
+    if (osize < isize - MPPE_OVHD - 2) {
+       printk(KERN_DEBUG "mppe_decompress[%d]: osize too small! "
+              "(have: %d need: %d)\n", state->unit,
+              osize, isize - MPPE_OVHD - 2);
+       return DECOMP_ERROR;
+    }
     osize = isize - MPPE_OVHD - 2;
 
     ccount = MPPE_CCOUNT(ibuf);
+    if (state->debug >= 7)
+       printk(KERN_DEBUG "mppe_decompress[%d]: ccount %d\n", state->unit,
+              ccount);
 
     /* sanity checks -- terminate with extreme prejudice */
     if (!(MPPE_BITS(ibuf) & MPPE_BIT_ENCRYPTED)) {
@@ -508,11 +519,11 @@ mppe_decompress(void *arg, unsigned char *ibuf, int isize, unsigned char *obuf,
      * comes from the decrypted data.
      */
     obuf[0] = PPP_ADDRESS(ibuf);       /* +1 */
-    obuf[1] = PPP_CONTROL(ibuf);       /* +2 */
+    obuf[1] = PPP_CONTROL(ibuf);       /* +1 */
     obuf  += 2;
     ibuf  += PPP_HDRLEN + MPPE_OVHD;
     isize -= PPP_HDRLEN + MPPE_OVHD;   /* -6 */
-                                       /* net: -4 */
+                                       /* net osize: isize-4 */
 
     /* And finally, decrypt the packet. */
     arcfour_decrypt(&state->arcfour_context, ibuf, isize, obuf);
@@ -539,7 +550,6 @@ mppe_incomp(void *arg, unsigned char *ibuf, int icnt)
 {
     ppp_mppe_state *state = (ppp_mppe_state *) arg;
 
-/* XXX */
     if (state->debug &&
        (PPP_PROTOCOL(ibuf) >= 0x0021 && PPP_PROTOCOL(ibuf) <= 0x00fa))
        printk(KERN_DEBUG "mppe_incomp[%d]: incompressible (unencrypted) data! "