diff options
| -rw-r--r-- | lib/decompress_unlzma.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/lib/decompress_unlzma.c b/lib/decompress_unlzma.c index f30c899241ef..476c65af9709 100644 --- a/lib/decompress_unlzma.c +++ b/lib/decompress_unlzma.c @@ -522,6 +522,9 @@ static inline int INIT process_bit1(struct writer *wr, struct rc *rc, cst->rep0 = pos_slot; if (++(cst->rep0) == 0) return 0; + if (cst->rep0 > wr->header->dict_size + || cst->rep0 > get_pos(wr)) + return -1; } len += LZMA_MATCH_MIN_LEN; |