diff options
| author | Linus Torvalds <torvalds@linux-foundation.org> | 2014-06-23 17:05:28 -0700 |
|---|---|---|
| committer | Linus Torvalds <torvalds@linux-foundation.org> | 2014-06-23 17:05:28 -0700 |
| commit | 8b8f5d9715845f9ae2b89ce406e71877965b29ca (patch) | |
| tree | 2d8052aaec3138e5871ad675cf15370fbf27f1ac /lib/lz4/lz4_decompress.c | |
| parent | 04b5da4a14eef2ed1b92fd762be80fa1ba7a6461 (diff) | |
| parent | 206204a1162b995e2185275167b22468c00d6b36 (diff) | |
| download | linux-8b8f5d9715845f9ae2b89ce406e71877965b29ca.tar.gz linux-8b8f5d9715845f9ae2b89ce406e71877965b29ca.tar.bz2 linux-8b8f5d9715845f9ae2b89ce406e71877965b29ca.zip | |
Merge tag 'compress-3.16-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core
Pull compress bugfixes from Greg KH:
"Here are two bugfixes for some compression functions that resolve some
errors when uncompressing some pathalogical data. Both were found by
Don A Bailey"
* tag 'compress-3.16-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core:
lz4: ensure length does not wrap
lzo: properly check for overruns
Diffstat (limited to 'lib/lz4/lz4_decompress.c')
| -rw-r--r-- | lib/lz4/lz4_decompress.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/lib/lz4/lz4_decompress.c b/lib/lz4/lz4_decompress.c index df6839e3ce08..99a03acb7d47 100644 --- a/lib/lz4/lz4_decompress.c +++ b/lib/lz4/lz4_decompress.c @@ -72,6 +72,8 @@ static int lz4_uncompress(const char *source, char *dest, int osize) len = *ip++; for (; len == 255; length += 255) len = *ip++; + if (unlikely(length > (size_t)(length + len))) + goto _output_error; length += len; } |