diff options
| author | Lasse Collin <lasse.collin@tukaani.org> | 2011-01-12 17:01:19 -0800 |
|---|---|---|
| committer | Linus Torvalds <torvalds@linux-foundation.org> | 2011-01-13 08:03:24 -0800 |
| commit | eb0cf3e19b4940a2d26dcdea03510ae16a580fcd (patch) | |
| tree | fb7eabafd37cdddee9c082bb29844474699f6a8f /lib/decompress_unlzma.c | |
| parent | 528941ca05734f24a7568c1c082125f2b635c4eb (diff) | |
| download | lwn-eb0cf3e19b4940a2d26dcdea03510ae16a580fcd.tar.gz lwn-eb0cf3e19b4940a2d26dcdea03510ae16a580fcd.zip | |
Decompressors: validate match distance in decompress_unlzma.c
Validate the newly decoded distance (rep0) in process_bit1(). This is to
detect corrupt LZMA data quickly. The old code can run for long time
producing garbage until it hits the end of the input.
Signed-off-by: Lasse Collin <lasse.collin@tukaani.org>
Cc: "H. Peter Anvin" <hpa@zytor.com>
Cc: Alain Knaff <alain@knaff.lu>
Cc: Albin Tonnerre <albin.tonnerre@free-electrons.com>
Cc: Phillip Lougher <phillip@lougher.demon.co.uk>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Diffstat (limited to 'lib/decompress_unlzma.c')
| -rw-r--r-- | lib/decompress_unlzma.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/lib/decompress_unlzma.c b/lib/decompress_unlzma.c index f30c899241ef..476c65af9709 100644 --- a/lib/decompress_unlzma.c +++ b/lib/decompress_unlzma.c @@ -522,6 +522,9 @@ static inline int INIT process_bit1(struct writer *wr, struct rc *rc, cst->rep0 = pos_slot; if (++(cst->rep0) == 0) return 0; + if (cst->rep0 > wr->header->dict_size + || cst->rep0 > get_pos(wr)) + return -1; } len += LZMA_MATCH_MIN_LEN; |