diff options
author | Thomas Gleixner <tglx@linutronix.de> | 2015-04-08 21:26:21 (GMT) |
---|---|---|
committer | Thomas Gleixner <tglx@linutronix.de> | 2015-04-08 21:26:21 (GMT) |
commit | 462b69b1e43ceccab68a47d65b1e46520cd0fdc0 (patch) | |
tree | 3c961fcb5889c5ab14ab36d8ef7421fc96c95959 /lib/lz4/lz4_decompress.c | |
parent | d8bf368d0631d4bc2612d8bf2e4e8e74e620d0cc (diff) | |
parent | f22e6e847115abc3a0e2ad7bb18d243d42275af1 (diff) | |
download | linux-462b69b1e43ceccab68a47d65b1e46520cd0fdc0.tar.xz |
Merge branch 'linus' into irq/core to get the GIC updates which
conflict with pending GIC changes.
Conflicts:
drivers/usb/isp1760/isp1760-core.c
Diffstat (limited to 'lib/lz4/lz4_decompress.c')
-rw-r--r-- | lib/lz4/lz4_decompress.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/lib/lz4/lz4_decompress.c b/lib/lz4/lz4_decompress.c index 7a85967..f0f5c5c 100644 --- a/lib/lz4/lz4_decompress.c +++ b/lib/lz4/lz4_decompress.c @@ -139,6 +139,9 @@ static int lz4_uncompress(const char *source, char *dest, int osize) /* Error: request to write beyond destination buffer */ if (cpy > oend) goto _output_error; + if ((ref + COPYLENGTH) > oend || + (op + COPYLENGTH) > oend) + goto _output_error; LZ4_SECURECOPY(ref, op, (oend - COPYLENGTH)); while (op < cpy) *op++ = *ref++; |