aboutsummaryrefslogtreecommitdiffstats
path: root/lib/decompress_inflate.c
diff options
context:
space:
mode:
authorPhillip Lougher <phillip@lougher.demon.co.uk>2009-09-23 18:57:37 -0400
committerLinus Torvalds <torvalds@linux-foundation.org>2009-09-24 10:21:05 -0400
commit6a8811629e9aa611aa710162f9e02020bba52c87 (patch)
treed3b8ff16950f5cda94b3259fbfa097aea9cb1e5f /lib/decompress_inflate.c
parent3354f73b24c6d392ed7fd5583cfcc7604c1934ae (diff)
lzma/gzip: fix potential oops when input data is truncated
If the lzma/gzip decompressors are called with insufficient input data (len > 0 & fill = NULL), they will attempt to call the fill function to obtain more data, leading to a kernel oops. Signed-off-by: Phillip Lougher <phillip@lougher.demon.co.uk> Cc: "H. Peter Anvin" <hpa@zytor.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Diffstat (limited to 'lib/decompress_inflate.c')
-rw-r--r--lib/decompress_inflate.c8
1 files changed, 8 insertions, 0 deletions
diff --git a/lib/decompress_inflate.c b/lib/decompress_inflate.c
index 68dfce59c1b8..fc686c7a0a0d 100644
--- a/lib/decompress_inflate.c
+++ b/lib/decompress_inflate.c
@@ -27,6 +27,11 @@
27 27
28#define GZIP_IOBUF_SIZE (16*1024) 28#define GZIP_IOBUF_SIZE (16*1024)
29 29
30static int nofill(void *buffer, unsigned int len)
31{
32 return -1;
33}
34
30/* Included from initramfs et al code */ 35/* Included from initramfs et al code */
31STATIC int INIT gunzip(unsigned char *buf, int len, 36STATIC int INIT gunzip(unsigned char *buf, int len,
32 int(*fill)(void*, unsigned int), 37 int(*fill)(void*, unsigned int),
@@ -76,6 +81,9 @@ STATIC int INIT gunzip(unsigned char *buf, int len,
76 goto gunzip_nomem4; 81 goto gunzip_nomem4;
77 } 82 }
78 83
84 if (!fill)
85 fill = nofill;
86
79 if (len == 0) 87 if (len == 0)
80 len = fill(zbuf, GZIP_IOBUF_SIZE); 88 len = fill(zbuf, GZIP_IOBUF_SIZE);
81 89