Pull compress bugfix from Greg KH: "Here is another lz4 bugfix for 3.16-rc3 that resolves a reported issue with that compression algorithm" * tag 'compress-3.16-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core: lz4: fix another possible overrun
Unified · Split
| @@ -108,6 +108,8 @@ static int lz4_uncompress(const char *source, char *dest, int osize) · 107 unmodified lines | |||
| 108 | if (length == ML_MASK) { | 108 | if (length == ML_MASK) { |
| 109 | for (; *ip == 255; length += 255) | 109 | for (; *ip == 255; length += 255) |
| 110 | ip++; | 110 | ip++; |
| 111 | if (unlikely(length > (size_t)(length + *ip))) | ||
| 112 | goto _output_error; | ||
| 111 | length += *ip++; | 113 | length += *ip++; |
| 112 | } | 114 | } |
| 113 | 115 | ||
| @@ -157,7 +159,7 @@ static int lz4_uncompress(const char *source, char *dest, int osize) · 43 unmodified lines | |||
| 157 | 159 | ||
| 158 | /* write overflow error detected */ | 160 | /* write overflow error detected */ |
| 159 | _output_error: | 161 | _output_error: |
| 160 | return (int) (-(((char *)ip) - source)); | 162 | return -1; |
| 161 | } | 163 | } |
| 162 | 164 | ||
| 163 | static int lz4_uncompress_unknownoutputsize(const char *source, char *dest, | 165 | static int lz4_uncompress_unknownoutputsize(const char *source, char *dest, |