summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorLasse Collin <lasse.collin@tukaani.org>2011-01-12 17:01:19 -0800
committerLinus Torvalds <torvalds@linux-foundation.org>2011-01-13 08:03:24 -0800
commiteb0cf3e19b4940a2d26dcdea03510ae16a580fcd (patch)
treefb7eabafd37cdddee9c082bb29844474699f6a8f
parent528941ca05734f24a7568c1c082125f2b635c4eb (diff)
Decompressors: validate match distance in decompress_unlzma.c
Validate the newly decoded distance (rep0) in process_bit1(). This is to detect corrupt LZMA data quickly. The old code can run for long time producing garbage until it hits the end of the input. Signed-off-by: Lasse Collin <lasse.collin@tukaani.org> Cc: "H. Peter Anvin" <hpa@zytor.com> Cc: Alain Knaff <alain@knaff.lu> Cc: Albin Tonnerre <albin.tonnerre@free-electrons.com> Cc: Phillip Lougher <phillip@lougher.demon.co.uk> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
-rw-r--r--lib/decompress_unlzma.c3
1 files changed, 3 insertions, 0 deletions
diff --git a/lib/decompress_unlzma.c b/lib/decompress_unlzma.c
index f30c899241ef..476c65af9709 100644
--- a/lib/decompress_unlzma.c
+++ b/lib/decompress_unlzma.c
@@ -522,6 +522,9 @@ static inline int INIT process_bit1(struct writer *wr, struct rc *rc,
cst->rep0 = pos_slot;
if (++(cst->rep0) == 0)
return 0;
+ if (cst->rep0 > wr->header->dict_size
+ || cst->rep0 > get_pos(wr))
+ return -1;
}
len += LZMA_MATCH_MIN_LEN;