diff options
| author | David S. Miller <davem@davemloft.net> | 2014-07-16 14:09:34 -0700 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2014-07-16 14:09:34 -0700 |
| commit | 1a98c69af1ecd97bfd1f4e4539924a9192434e36 (patch) | |
| tree | a243defcf921ea174f8e43fce11d06830a6a9c36 /lib/lz4/lz4_decompress.c | |
| parent | 7a575f6b907ea5d207d2b5010293c189616eae34 (diff) | |
| parent | b6603fe574af289dbe9eb9fb4c540bca04f5a053 (diff) | |
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'lib/lz4/lz4_decompress.c')
| -rw-r--r-- | lib/lz4/lz4_decompress.c | 10 |
1 files changed, 8 insertions, 2 deletions
diff --git a/lib/lz4/lz4_decompress.c b/lib/lz4/lz4_decompress.c index 99a03acb7d47..7a85967060a5 100644 --- a/lib/lz4/lz4_decompress.c +++ b/lib/lz4/lz4_decompress.c @@ -108,6 +108,8 @@ static int lz4_uncompress(const char *source, char *dest, int osize) if (length == ML_MASK) { for (; *ip == 255; length += 255) ip++; + if (unlikely(length > (size_t)(length + *ip))) + goto _output_error; length += *ip++; } @@ -157,7 +159,7 @@ static int lz4_uncompress(const char *source, char *dest, int osize) /* write overflow error detected */ _output_error: - return (int) (-(((char *)ip) - source)); + return -1; } static int lz4_uncompress_unknownoutputsize(const char *source, char *dest, @@ -190,6 +192,8 @@ static int lz4_uncompress_unknownoutputsize(const char *source, char *dest, int s = 255; while ((ip < iend) && (s == 255)) { s = *ip++; + if (unlikely(length > (size_t)(length + s))) + goto _output_error; length += s; } } @@ -230,6 +234,8 @@ static int lz4_uncompress_unknownoutputsize(const char *source, char *dest, if (length == ML_MASK) { while (ip < iend) { int s = *ip++; + if (unlikely(length > (size_t)(length + s))) + goto _output_error; length += s; if (s == 255) continue; @@ -282,7 +288,7 @@ static int lz4_uncompress_unknownoutputsize(const char *source, char *dest, /* write overflow error detected */ _output_error: - return (int) (-(((char *) ip) - source)); + return -1; } int lz4_decompress(const unsigned char *src, size_t *src_len, |