ppp: bound Predictor-1 decompression output

[nprice]

Summary

Pred1Input() decompressed CCP data into a MAX_MRU+2 mbuf with no limit
on the output, so a peer could expand a short compressed frame (up to
8:1) past the buffer and overflow adjacent heap. An input length below
4 also drove decompress() with a negative length.

Reject out-of-range input lengths and stop decompression at the
destination buffer size.

[markj]

usr.sbin/ppp/pred.c

102

I'd also make len and destlen have type size_t.

118–119

If we can legitimately have len == 0 here, then with this patch that case will be caught above and we'll return -1 instead of dest - orgdest. I'm not sure if that's a real problem in practice.

233

I suspect olen should be a size_t.

[nprice]

Switch buffer lengths to size_t, reorder checks to fix erroneous
-1 return with exact-size frame length