Commit 1da914e0 authored by Lasse Collin's avatar Lasse Collin Committed by Linus Torvalds

decompressors: check input size in decompress_inflate.c

Check for end of the input buffer when skipping over the filename field in
the .gz file header.
Signed-off-by: default avatarLasse Collin <lasse.collin@tukaani.org>
Cc: "H. Peter Anvin" <hpa@zytor.com>
Cc: Alain Knaff <alain@knaff.lu>
Cc: Albin Tonnerre <albin.tonnerre@free-electrons.com>
Cc: Phillip Lougher <phillip@lougher.demon.co.uk>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent 30314804
...@@ -98,13 +98,22 @@ STATIC int INIT gunzip(unsigned char *buf, int len, ...@@ -98,13 +98,22 @@ STATIC int INIT gunzip(unsigned char *buf, int len,
* possible asciz filename) * possible asciz filename)
*/ */
strm->next_in = zbuf + 10; strm->next_in = zbuf + 10;
strm->avail_in = len - 10;
/* skip over asciz filename */ /* skip over asciz filename */
if (zbuf[3] & 0x8) { if (zbuf[3] & 0x8) {
while (strm->next_in[0]) do {
strm->next_in++; /*
strm->next_in++; * If the filename doesn't fit into the buffer,
* the file is very probably corrupt. Don't try
* to read more data.
*/
if (strm->avail_in == 0) {
error("header error");
goto gunzip_5;
}
--strm->avail_in;
} while (*strm->next_in++);
} }
strm->avail_in = len - (strm->next_in - zbuf);
strm->next_out = out_buf; strm->next_out = out_buf;
strm->avail_out = out_len; strm->avail_out = out_len;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment