Pull compress bugfix from Greg KH: "Here is another lz4 bugfix for 3.16-rc3 that resolves a reported issue with that compression algorithm" * tag 'compress-3.16-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core: lz4: fix another possible overrun
Unified · Split
| @@ -108,6 +108,8 @@ static int lz4_uncompress(const char *source, char *dest, int osize) · 107 unmodified lines | ||
| 108 | 108 | if (length == ML_MASK) { |
| 109 | 109 | for (; *ip == 255; length += 255) |
| 110 | 110 | ip++; |
| 111 | + if (unlikely(length > (size_t)(length + *ip))) | |
| 112 | + goto _output_error; | |
| 111 | 113 | length += *ip++; |
| 112 | 114 | } |
| 113 | 115 | |
| @@ -157,7 +159,7 @@ static int lz4_uncompress(const char *source, char *dest, int osize) · 43 unmodified lines | ||
| 157 | 159 | |
| 158 | 160 | /* write overflow error detected */ |
| 159 | 161 | _output_error: |
| 160 | − return (int) (-(((char *)ip) - source)); | |
| 162 | + return -1; | |
| 161 | 163 | } |
| 162 | 164 | |
| 163 | 165 | static int lz4_uncompress_unknownoutputsize(const char *source, char *dest, |