Re: [PATCH net] ppp: deflate: validate output buffer sizes

[Paul Mackerras]

On Mon, Sep 07, 2026 at 01:58:09PM +0800, Yilin Zhang wrote:
> z_compress() assumes that the output buffer can hold the six-byte
> PPP/Deflate header.  With an MTU of 1, pad_compress_skb() supplies an
> output size of 5.  The header write overruns the skb and subtracting the
> header length makes avail_out wrap, allowing zlib to continue writing
> past the allocation.

Why not rather enforce a reasonable minimum for the MTU?  I don't see
how an MTU of 1 is practically useful in any way.  A practical minimum
would be on the order or 100; when negotiating with the peer, pppd
naks anything less than 128 and proposes 128 instead.

Paul.