lz4: ensure length does not wrap
(cherry pick from commit 206204a1162b995e2185275167b22468c00d6b36) Given some pathologically compressed data, lz4 could possibly decide to wrap a few internal variables, causing unknown things to happen. Catch this before the wrapping happens and abort the decompression. Reported-by: "Don A. Bailey" <donb@securitymouse.com> Cc: stable <stable@vger.kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Bug: 24810447 Change-Id: Ie008fb8b69f1a1bbf40900fe2d49fff41e7d300b
This commit is contained in:
parent
ae2aa8e461
commit
c7e2ef1173
|
@ -72,6 +72,8 @@ static int lz4_uncompress(const char *source, char *dest, int osize)
|
|||
len = *ip++;
|
||||
for (; len == 255; length += 255)
|
||||
len = *ip++;
|
||||
if (unlikely(length > (size_t)(length + len)))
|
||||
goto _output_error;
|
||||
length += len;
|
||||
}
|
||||
|
||||
|
|
Loading…
Reference in New Issue