diff options
| author | David S. Miller <davem@davemloft.net> | 2015-03-24 03:22:43 +0100 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2015-03-24 03:22:43 +0100 |
| commit | d5c1d8c567781932e3ab2c62e8fcfee0283d9580 (patch) | |
| tree | c04fca1719409426b42af6a7caa75cc26ba940a9 /lib/lz4 | |
| parent | rhashtable: Fix sleeping inside RCU critical section in walk_stop (diff) | |
| parent | Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net (diff) | |
| download | linux-d5c1d8c567781932e3ab2c62e8fcfee0283d9580.tar.xz linux-d5c1d8c567781932e3ab2c62e8fcfee0283d9580.zip | |
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
Conflicts:
net/netfilter/nf_tables_core.c
The nf_tables_core.c conflict was resolved using a conflict resolution
from Stephen Rothwell as a guide.
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'lib/lz4')
| -rw-r--r-- | lib/lz4/lz4_decompress.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/lib/lz4/lz4_decompress.c b/lib/lz4/lz4_decompress.c index 7a85967060a5..f0f5c5c3de12 100644 --- a/lib/lz4/lz4_decompress.c +++ b/lib/lz4/lz4_decompress.c @@ -139,6 +139,9 @@ static int lz4_uncompress(const char *source, char *dest, int osize) /* Error: request to write beyond destination buffer */ if (cpy > oend) goto _output_error; + if ((ref + COPYLENGTH) > oend || + (op + COPYLENGTH) > oend) + goto _output_error; LZ4_SECURECOPY(ref, op, (oend - COPYLENGTH)); while (op < cpy) *op++ = *ref++; |