Dan Carpenter 42ddd03e80 decompress_bunzip2: off by one in get_next_block() ... commit b5c8afe5be51078a979d86ae5ae78c4ac948063d upstream. "origPtr" is used as an offset into the bd->dbuf[] array. That array is allocated in start_bunzip() and has "bd->dbufSize" number of elements so the test here should be >= instead of >. Later we check "origPtr" again before using it as an offset so I don't know if this bug can be triggered in real life. Fixes: bc22c17e12 ('bzip2/lzma: library support for gzip, bzip2 and lzma decompression') Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Cc: Alain Knaff <alain@knaff.lu> Cc: Yinghai Lu <yinghai@kernel.org> Cc: "H. Peter Anvin" <hpa@zytor.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2015-01-27 07:52:33 -08:00
..
lzo	lzo: check for length overrun in variable length encoding.	2014-10-30 09:35:11 -07:00
mpi
raid6
reed_solomon
xz
zlib_deflate
zlib_inflate
.gitignore
argv_split.c
asn1_decoder.c
atomic64.c
atomic64_test.c
audit.c
average.c
bcd.c
bch.c
bitmap.c	lib/bitmap.c: fix undefined shift in __bitmap_shift_{left|right}()	2014-11-14 08:47:59 -08:00
bitrev.c
bsearch.c
btree.c	lib/btree.c: fix leak of whole btree nodes	2014-08-07 14:30:27 -07:00
bug.c
build_OID_registry
bust_spinlocks.c
check_signature.c
checksum.c
clz_tab.c
cmdline.c
cordic.c
cpu-notifier-error-inject.c
cpu_rmap.c
cpumask.c
crc-ccitt.c
crc-itu-t.c
crc-t10dif.c
crc7.c
crc8.c
crc16.c
crc32.c
crc32defs.h
ctype.c
debug_locks.c
debugobjects.c
dec_and_lock.c
decompress.c
decompress_bunzip2.c	decompress_bunzip2: off by one in get_next_block()	2015-01-27 07:52:33 -08:00
decompress_inflate.c	lib/decompressors: fix "no limit" output buffer length	2014-02-06 11:08:12 -08:00
decompress_unlzma.c
decompress_unlzo.c
decompress_unxz.c
devres.c
digsig.c
div64.c
dma-debug.c
dump_stack.c
dynamic_debug.c
dynamic_queue_limits.c
earlycpio.c
extable.c
fault-inject.c
fdt.c
fdt_ro.c
fdt_rw.c
fdt_strerror.c
fdt_sw.c
fdt_wip.c
find_last_bit.c
find_next_bit.c
flex_array.c
flex_proportions.c
gcd.c
gen_crc32table.c
genalloc.c	lib/genalloc.c: fix overflow of ending address of memory chunk	2013-12-11 22:36:28 -08:00
halfmd4.c
hexdump.c
hweight.c
idr.c	idr: fix overflow bug during maximum ID calculation at maximum height	2014-06-30 20:09:42 -07:00
inflate.c
int_sqrt.c
interval_tree.c
interval_tree_test_main.c
iomap.c
iomap_copy.c
iommu-helper.c
ioremap.c
iovec.c
irq_regs.c
is_single_threaded.c
jedec_ddr_data.c
kasprintf.c
Kconfig
Kconfig.debug
Kconfig.kgdb
Kconfig.kmemcheck
kfifo.c
klist.c
kobject.c
kobject_uevent.c
kstrtox.c
kstrtox.h
lcm.c
libcrc32c.c
list_debug.c
list_sort.c
llist.c
locking-selftest-hardirq.h
locking-selftest-mutex.h
locking-selftest-rlock-hardirq.h
locking-selftest-rlock-softirq.h
locking-selftest-rlock.h
locking-selftest-rsem.h
locking-selftest-softirq.h
locking-selftest-spin-hardirq.h
locking-selftest-spin-softirq.h
locking-selftest-spin.h
locking-selftest-wlock-hardirq.h
locking-selftest-wlock-softirq.h
locking-selftest-wlock.h
locking-selftest-wsem.h
locking-selftest.c
lru_cache.c
Makefile	x86, hweight: Fix BUG when booting with CONFIG_GCOV_PROFILE_ALL=y	2014-02-20 11:06:11 -08:00
md5.c
memory-notifier-error-inject.c
memweight.c
nlattr.c	netlink: rate-limit leftover bytes warning and print process name	2014-06-26 15:12:37 -04:00
notifier-error-inject.c
notifier-error-inject.h
of-reconfig-notifier-error-inject.c
oid_registry.c
parser.c
pci_iomap.c
percpu-rwsem.c
percpu_counter.c
plist.c
pm-notifier-error-inject.c
prio_heap.c
proportions.c
radix-tree.c
random32.c	random32: fix off-by-one in seeding requirement	2013-12-08 07:29:24 -08:00
ratelimit.c
rational.c
rbtree.c
rbtree_test.c
reciprocal_div.c
rwsem-spinlock.c
rwsem.c
scatterlist.c
sha1.c
show_mem.c
smp_processor_id.c
sort.c
spinlock_debug.c
stmp_device.c
string.c	random: add and use memzero_explicit() for clearing data	2014-11-14 08:47:55 -08:00
string_helpers.c
strncpy_from_user.c
strnlen_user.c
swiotlb.c
syscall.c
test-kstrtox.c
test-string_helpers.c
textsearch.c
timerqueue.c
ts_bm.c
ts_fsm.c
ts_kmp.c
ucs2_string.c
usercopy.c
uuid.c
vsprintf.c