lz4: ensure length does not wrap
Note: this is the same as 206204a1162b995e2185275167b22468c00d6b36 in linux-git. Given some pathologically compressed data, lz4 could possibly decide to wrap a few internal variables, causing unknown things to happen. Catch this before the wrapping happens and abort the decompression. Reported-by: "Don A. Bailey" <donb@securitymouse.com> Signed-off-by: Holger Schurig <holgerschurig@gmail.de> Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
This commit is contained in:
parent
ecb1dc0b1e
commit
918782bb0f
|
@ -73,6 +73,8 @@ static int lz4_uncompress(const char *source, char *dest, int osize)
|
|||
len = *ip++;
|
||||
for (; len == 255; length += 255)
|
||||
len = *ip++;
|
||||
if (unlikely(length > (size_t)(length + len)))
|
||||
goto _output_error;
|
||||
length += len;
|
||||
}
|
||||
|
||||
|
|
Loading…
Reference in New Issue