diff options
| author | Stefano Babic <sbabic@denx.de> | 2013-09-13 12:04:54 +0200 |
|---|---|---|
| committer | Stefano Babic <sbabic@denx.de> | 2013-09-13 12:10:07 +0200 |
| commit | c4a7ece02046f647019cc0aaddf530833a8db29c (patch) | |
| tree | 06342cd9b8cc41b95442a992fb38a1bc8671b05c /lib/lzo/lzo1x_decompress.c | |
| parent | b5e7f1bc4b899ea34e838d5d60b3e6f8e479d0a9 (diff) | |
| parent | 8386ca8bea7a6a8469c3b6a99313afb642e6cbeb (diff) | |
| download | u-boot-c4a7ece02046f647019cc0aaddf530833a8db29c.zip u-boot-c4a7ece02046f647019cc0aaddf530833a8db29c.tar.gz u-boot-c4a7ece02046f647019cc0aaddf530833a8db29c.tar.bz2 | |
Merge branch 'master' of git://git.denx.de/u-boot-arm
Conflicts:
MAINTAINERS
boards.cfg
Signed-off-by: Stefano Babic <sbabic@denx.de>
Diffstat (limited to 'lib/lzo/lzo1x_decompress.c')
| -rw-r--r-- | lib/lzo/lzo1x_decompress.c | 8 |
1 files changed, 7 insertions, 1 deletions
diff --git a/lib/lzo/lzo1x_decompress.c b/lib/lzo/lzo1x_decompress.c index e6ff708..35f3793 100644 --- a/lib/lzo/lzo1x_decompress.c +++ b/lib/lzo/lzo1x_decompress.c @@ -68,13 +68,14 @@ int lzop_decompress(const unsigned char *src, size_t src_len, unsigned char *start = dst; const unsigned char *send = src + src_len; u32 slen, dlen; - size_t tmp; + size_t tmp, remaining; int r; src = parse_header(src); if (!src) return LZO_E_ERROR; + remaining = *dst_len; while (src < send) { /* read uncompressed block size */ dlen = get_unaligned_be32(src); @@ -93,6 +94,10 @@ int lzop_decompress(const unsigned char *src, size_t src_len, if (slen <= 0 || slen > dlen) return LZO_E_ERROR; + /* abort if buffer ran out of room */ + if (dlen > remaining) + return LZO_E_OUTPUT_OVERRUN; + /* decompress */ tmp = dlen; r = lzo1x_decompress_safe((u8 *) src, slen, dst, &tmp); @@ -105,6 +110,7 @@ int lzop_decompress(const unsigned char *src, size_t src_len, src += slen; dst += dlen; + remaining -= dlen; } return LZO_E_INPUT_OVERRUN; |