summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorLinus Torvalds <torvalds@linux-foundation.org>2014-06-28 05:33:49 +0400
committerLinus Torvalds <torvalds@linux-foundation.org>2014-06-28 05:33:49 +0400
commit8dd68eb3cae6ec74ffbbe592ec7780e6e16e3913 (patch)
treec399c0b5c1ea68d5529a5c16ce13a3a777f0aa8f
parent772205d8e4d87f22e74d9a6c05cf0e217a0e5f46 (diff)
parent4148c1f67abf823099b2d7db6851e4aea407f5ee (diff)
downloadlinux-8dd68eb3cae6ec74ffbbe592ec7780e6e16e3913.tar.xz
Merge tag 'compress-3.16-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core
Pull compress bugfix from Greg KH: "Here is another lz4 bugfix for 3.16-rc3 that resolves a reported issue with that compression algorithm" * tag 'compress-3.16-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core: lz4: fix another possible overrun
-rw-r--r--lib/lz4/lz4_decompress.c4
1 files changed, 3 insertions, 1 deletions
diff --git a/lib/lz4/lz4_decompress.c b/lib/lz4/lz4_decompress.c
index 99a03acb7d47..b74da447e81e 100644
--- a/lib/lz4/lz4_decompress.c
+++ b/lib/lz4/lz4_decompress.c
@@ -108,6 +108,8 @@ static int lz4_uncompress(const char *source, char *dest, int osize)
if (length == ML_MASK) {
for (; *ip == 255; length += 255)
ip++;
+ if (unlikely(length > (size_t)(length + *ip)))
+ goto _output_error;
length += *ip++;
}
@@ -157,7 +159,7 @@ static int lz4_uncompress(const char *source, char *dest, int osize)
/* write overflow error detected */
_output_error:
- return (int) (-(((char *)ip) - source));
+ return -1;
}
static int lz4_uncompress_unknownoutputsize(const char *source, char *dest,