summaryrefslogtreecommitdiffstats
path: root/lib
diff options
context:
space:
mode:
authorLasse Collin <lasse.collin@tukaani.org>2011-01-12 17:01:25 -0800
committerLinus Torvalds <torvalds@linux-foundation.org>2011-01-13 08:03:25 -0800
commit1da914e0648ace34e1c3738d9584e8b2cd6fe64a (patch)
treed52798bed2086ea7fd9182ff1e9ddae8b09c4740 /lib
parent303148045aac34b70db722a54e5ad94a3a6625c6 (diff)
downloadlinux-1da914e0648ace34e1c3738d9584e8b2cd6fe64a.tar.gz
linux-1da914e0648ace34e1c3738d9584e8b2cd6fe64a.tar.bz2
linux-1da914e0648ace34e1c3738d9584e8b2cd6fe64a.zip
decompressors: check input size in decompress_inflate.c
Check for end of the input buffer when skipping over the filename field in the .gz file header. Signed-off-by: Lasse Collin <lasse.collin@tukaani.org> Cc: "H. Peter Anvin" <hpa@zytor.com> Cc: Alain Knaff <alain@knaff.lu> Cc: Albin Tonnerre <albin.tonnerre@free-electrons.com> Cc: Phillip Lougher <phillip@lougher.demon.co.uk> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Diffstat (limited to 'lib')
-rw-r--r--lib/decompress_inflate.c17
1 files changed, 13 insertions, 4 deletions
diff --git a/lib/decompress_inflate.c b/lib/decompress_inflate.c
index b5fe1d1d5f05..19ff89e34eec 100644
--- a/lib/decompress_inflate.c
+++ b/lib/decompress_inflate.c
@@ -98,13 +98,22 @@ STATIC int INIT gunzip(unsigned char *buf, int len,
* possible asciz filename)
*/
strm->next_in = zbuf + 10;
+ strm->avail_in = len - 10;
/* skip over asciz filename */
if (zbuf[3] & 0x8) {
- while (strm->next_in[0])
- strm->next_in++;
- strm->next_in++;
+ do {
+ /*
+ * If the filename doesn't fit into the buffer,
+ * the file is very probably corrupt. Don't try
+ * to read more data.
+ */
+ if (strm->avail_in == 0) {
+ error("header error");
+ goto gunzip_5;
+ }
+ --strm->avail_in;
+ } while (*strm->next_in++);
}
- strm->avail_in = len - (strm->next_in - zbuf);
strm->next_out = out_buf;
strm->avail_out = out_len;