diff options
Diffstat (limited to 'fs/binfmt_flat.c')
-rw-r--r-- | fs/binfmt_flat.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/fs/binfmt_flat.c b/fs/binfmt_flat.c index dfc0197905ca..ccb781a6a804 100644 --- a/fs/binfmt_flat.c +++ b/fs/binfmt_flat.c | |||
@@ -229,13 +229,13 @@ static int decompress_exec( | |||
229 | ret = 10; | 229 | ret = 10; |
230 | if (buf[3] & EXTRA_FIELD) { | 230 | if (buf[3] & EXTRA_FIELD) { |
231 | ret += 2 + buf[10] + (buf[11] << 8); | 231 | ret += 2 + buf[10] + (buf[11] << 8); |
232 | if (unlikely(LBUFSIZE == ret)) { | 232 | if (unlikely(LBUFSIZE <= ret)) { |
233 | DBG_FLT("binfmt_flat: buffer overflow (EXTRA)?\n"); | 233 | DBG_FLT("binfmt_flat: buffer overflow (EXTRA)?\n"); |
234 | goto out_free_buf; | 234 | goto out_free_buf; |
235 | } | 235 | } |
236 | } | 236 | } |
237 | if (buf[3] & ORIG_NAME) { | 237 | if (buf[3] & ORIG_NAME) { |
238 | for (; ret < LBUFSIZE && (buf[ret] != 0); ret++) | 238 | while (ret < LBUFSIZE && buf[ret++] != 0) |
239 | ; | 239 | ; |
240 | if (unlikely(LBUFSIZE == ret)) { | 240 | if (unlikely(LBUFSIZE == ret)) { |
241 | DBG_FLT("binfmt_flat: buffer overflow (ORIG_NAME)?\n"); | 241 | DBG_FLT("binfmt_flat: buffer overflow (ORIG_NAME)?\n"); |
@@ -243,7 +243,7 @@ static int decompress_exec( | |||
243 | } | 243 | } |
244 | } | 244 | } |
245 | if (buf[3] & COMMENT) { | 245 | if (buf[3] & COMMENT) { |
246 | for (; ret < LBUFSIZE && (buf[ret] != 0); ret++) | 246 | while (ret < LBUFSIZE && buf[ret++] != 0) |
247 | ; | 247 | ; |
248 | if (unlikely(LBUFSIZE == ret)) { | 248 | if (unlikely(LBUFSIZE == ret)) { |
249 | DBG_FLT("binfmt_flat: buffer overflow (COMMENT)?\n"); | 249 | DBG_FLT("binfmt_flat: buffer overflow (COMMENT)?\n"); |