diff options
| author | Lasse Collin <lasse.collin@tukaani.org> | 2011-01-13 02:01:19 +0100 |
|---|---|---|
| committer | Linus Torvalds <torvalds@linux-foundation.org> | 2011-01-13 17:03:24 +0100 |
| commit | eb0cf3e19b4940a2d26dcdea03510ae16a580fcd (patch) | |
| tree | fb7eabafd37cdddee9c082bb29844474699f6a8f /lib | |
| parent | Decompressors: check for write errors in decompress_unlzma.c (diff) | |
| download | linux-eb0cf3e19b4940a2d26dcdea03510ae16a580fcd.tar.xz linux-eb0cf3e19b4940a2d26dcdea03510ae16a580fcd.zip | |
Decompressors: validate match distance in decompress_unlzma.c
Validate the newly decoded distance (rep0) in process_bit1(). This is to
detect corrupt LZMA data quickly. The old code can run for long time
producing garbage until it hits the end of the input.
Signed-off-by: Lasse Collin <lasse.collin@tukaani.org>
Cc: "H. Peter Anvin" <hpa@zytor.com>
Cc: Alain Knaff <alain@knaff.lu>
Cc: Albin Tonnerre <albin.tonnerre@free-electrons.com>
Cc: Phillip Lougher <phillip@lougher.demon.co.uk>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Diffstat (limited to 'lib')
| -rw-r--r-- | lib/decompress_unlzma.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/lib/decompress_unlzma.c b/lib/decompress_unlzma.c index f30c899241ef..476c65af9709 100644 --- a/lib/decompress_unlzma.c +++ b/lib/decompress_unlzma.c @@ -522,6 +522,9 @@ static inline int INIT process_bit1(struct writer *wr, struct rc *rc, cst->rep0 = pos_slot; if (++(cst->rep0) == 0) return 0; + if (cst->rep0 > wr->header->dict_size + || cst->rep0 > get_pos(wr)) + return -1; } len += LZMA_MATCH_MIN_LEN; |