diff options
| author | Alex Shi <alex.shi@linaro.org> | 2015-03-30 11:22:08 +0800 |
|---|---|---|
| committer | Alex Shi <alex.shi@linaro.org> | 2015-03-30 11:22:08 +0800 |
| commit | 877c2196bf43e410b8b1a66c7bbf7d5cb98a9f41 (patch) | |
| tree | f74b6a59cd223c470830b3e4f3e1b6a4270abc1a /lib | |
| parent | b95b6a6ddfae1513893676e444f585a106513688 (diff) | |
| parent | 2dad587ec1dddf02a00d3b54156337a6dc79a752 (diff) | |
Merge branch 'linux-linaro-lsk-v3.14' into linux-linaro-lsk-v3.14-android
Conflicts:
net/netfilter/xt_socket.c
Diffstat (limited to 'lib')
| -rw-r--r-- | lib/lz4/lz4_decompress.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/lib/lz4/lz4_decompress.c b/lib/lz4/lz4_decompress.c index 7a85967060a5..f0f5c5c3de12 100644 --- a/lib/lz4/lz4_decompress.c +++ b/lib/lz4/lz4_decompress.c @@ -139,6 +139,9 @@ static int lz4_uncompress(const char *source, char *dest, int osize) /* Error: request to write beyond destination buffer */ if (cpy > oend) goto _output_error; + if ((ref + COPYLENGTH) > oend || + (op + COPYLENGTH) > oend) + goto _output_error; LZ4_SECURECOPY(ref, op, (oend - COPYLENGTH)); while (op < cpy) *op++ = *ref++; |