diff options
| author | Dmitry Torokhov <dmitry.torokhov@gmail.com> | 2015-03-23 09:18:27 -0700 |
|---|---|---|
| committer | Dmitry Torokhov <dmitry.torokhov@gmail.com> | 2015-03-23 09:18:27 -0700 |
| commit | 188933ac139a6f8ab06cad369bd0200af947b00d (patch) | |
| tree | c4c107528fcf6b82e32a93b0596e13eea7aa9385 /lib/lz4/lz4_decompress.c | |
| parent | 4ed0e032c3cf27c6fabc154164d003c4e0ac4654 (diff) | |
| parent | bc465aa9d045feb0e13b4a8f32cc33c1943f62d6 (diff) | |
Merge tag 'v4.0-rc5' into next
Merge with the latest upstream to synchronize Synaptics changes
and bring in new infrastructure pieces.
Conflicts:
drivers/input/mouse/synaptics.c
Diffstat (limited to 'lib/lz4/lz4_decompress.c')
| -rw-r--r-- | lib/lz4/lz4_decompress.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/lib/lz4/lz4_decompress.c b/lib/lz4/lz4_decompress.c index 7a85967060a5..f0f5c5c3de12 100644 --- a/lib/lz4/lz4_decompress.c +++ b/lib/lz4/lz4_decompress.c @@ -139,6 +139,9 @@ static int lz4_uncompress(const char *source, char *dest, int osize) /* Error: request to write beyond destination buffer */ if (cpy > oend) goto _output_error; + if ((ref + COPYLENGTH) > oend || + (op + COPYLENGTH) > oend) + goto _output_error; LZ4_SECURECOPY(ref, op, (oend - COPYLENGTH)); while (op < cpy) *op++ = *ref++; |