diff options
| author | Linus Torvalds <torvalds@linux-foundation.org> | 2014-06-27 18:33:49 -0700 |
|---|---|---|
| committer | Linus Torvalds <torvalds@linux-foundation.org> | 2014-06-27 18:33:49 -0700 |
| commit | 8dd68eb3cae6ec74ffbbe592ec7780e6e16e3913 (patch) | |
| tree | c399c0b5c1ea68d5529a5c16ce13a3a777f0aa8f | |
| parent | 772205d8e4d87f22e74d9a6c05cf0e217a0e5f46 (diff) | |
| parent | 4148c1f67abf823099b2d7db6851e4aea407f5ee (diff) | |
Merge tag 'compress-3.16-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core
Pull compress bugfix from Greg KH:
"Here is another lz4 bugfix for 3.16-rc3 that resolves a reported issue
with that compression algorithm"
* tag 'compress-3.16-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core:
lz4: fix another possible overrun
| -rw-r--r-- | lib/lz4/lz4_decompress.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/lib/lz4/lz4_decompress.c b/lib/lz4/lz4_decompress.c index 99a03acb7d47..b74da447e81e 100644 --- a/lib/lz4/lz4_decompress.c +++ b/lib/lz4/lz4_decompress.c @@ -108,6 +108,8 @@ static int lz4_uncompress(const char *source, char *dest, int osize) if (length == ML_MASK) { for (; *ip == 255; length += 255) ip++; + if (unlikely(length > (size_t)(length + *ip))) + goto _output_error; length += *ip++; } @@ -157,7 +159,7 @@ static int lz4_uncompress(const char *source, char *dest, int osize) /* write overflow error detected */ _output_error: - return (int) (-(((char *)ip) - source)); + return -1; } static int lz4_uncompress_unknownoutputsize(const char *source, char *dest, |