diff options
| author | Holger Schurig <holgerschurig@gmail.com> | 2014-07-01 23:22:05 +0200 |
|---|---|---|
| committer | Sascha Hauer <s.hauer@pengutronix.de> | 2014-07-02 08:19:45 +0200 |
| commit | 918782bb0fbdc5c7b58f9a25411ba7ac5975122e (patch) | |
| tree | ef4b624dcccbdd05c05cf8a611bb715ec85fe392 | |
| parent | ecb1dc0b1e859bca90bfb4b2d7c1d7fbb65e011b (diff) | |
| download | barebox-918782bb0fbdc5c7b58f9a25411ba7ac5975122e.tar.gz barebox-918782bb0fbdc5c7b58f9a25411ba7ac5975122e.tar.xz | |
lz4: ensure length does not wrap
Note: this is the same as 206204a1162b995e2185275167b22468c00d6b36 in
linux-git.
Given some pathologically compressed data, lz4 could possibly decide to
wrap a few internal variables, causing unknown things to happen. Catch
this before the wrapping happens and abort the decompression.
Reported-by: "Don A. Bailey" <donb@securitymouse.com>
Signed-off-by: Holger Schurig <holgerschurig@gmail.de>
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
| -rw-r--r-- | lib/lz4/lz4_decompress.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/lib/lz4/lz4_decompress.c b/lib/lz4/lz4_decompress.c index 8e64ce6aec..75cf08bd85 100644 --- a/lib/lz4/lz4_decompress.c +++ b/lib/lz4/lz4_decompress.c @@ -73,6 +73,8 @@ static int lz4_uncompress(const char *source, char *dest, int osize) len = *ip++; for (; len == 255; length += 255) len = *ip++; + if (unlikely(length > (size_t)(length + len))) + goto _output_error; length += len; } |