From 6b01ed64c19b52121a717274d271d9915f8d3e94 Mon Sep 17 00:00:00 2001 From: Lasse Collin Date: Wed, 12 Jan 2011 17:01:13 -0800 Subject: Decompressors: add missing INIT (i.e. __init) Signed-off-by: Lasse Collin Cc: "H. Peter Anvin" Cc: Alain Knaff Cc: Albin Tonnerre Cc: Phillip Lougher Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds --- lib/decompress_inflate.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'lib/decompress_inflate.c') diff --git a/lib/decompress_inflate.c b/lib/decompress_inflate.c index fc686c7a0a0d..1eea07e8f21b 100644 --- a/lib/decompress_inflate.c +++ b/lib/decompress_inflate.c @@ -27,7 +27,7 @@ #define GZIP_IOBUF_SIZE (16*1024) -static int nofill(void *buffer, unsigned int len) +static int INIT nofill(void *buffer, unsigned int len) { return -1; } -- cgit v1.2.2 From 93685ad247ef65b7d6f90ffe97b44f5cfeaf40d3 Mon Sep 17 00:00:00 2001 From: Lasse Collin Date: Wed, 12 Jan 2011 17:01:14 -0800 Subject: Decompressors: get rid of set_error_fn() macro set_error_fn() has become a useless complication after c1e7c3ae59 ("bzip2/lzma/gzip: pre-boot malloc doesn't return NULL on failure") fixed the use of error() in malloc(). Only decompress_unlzma.c had some use for it and that was easy to change too. This also gets rid of the static function pointer "error", which should have been marked as __initdata. Signed-off-by: Lasse Collin Cc: "H. Peter Anvin" Cc: Alain Knaff Cc: Albin Tonnerre Cc: Phillip Lougher Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds --- lib/decompress_inflate.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) (limited to 'lib/decompress_inflate.c') diff --git a/lib/decompress_inflate.c b/lib/decompress_inflate.c index 1eea07e8f21b..9a7f5dfc0ed7 100644 --- a/lib/decompress_inflate.c +++ b/lib/decompress_inflate.c @@ -38,13 +38,12 @@ STATIC int INIT gunzip(unsigned char *buf, int len, int(*flush)(void*, unsigned int), unsigned char *out_buf, int *pos, - void(*error_fn)(char *x)) { + void(*error)(char *x)) { u8 *zbuf; struct z_stream_s *strm; int rc; size_t out_len; - set_error_fn(error_fn); rc = -1; if (flush) { out_len = 0x8000; /* 32 K */ -- cgit v1.2.2 From 2b6b5caa6d05579bd1501006e34feec1b2aef8c4 Mon Sep 17 00:00:00 2001 From: Lasse Collin Date: Wed, 12 Jan 2011 17:01:15 -0800 Subject: Decompressors: include in Currently users of mm.h need to include to use the macros malloc() and free() provided by mm.h. This fixes it. Signed-off-by: Lasse Collin Cc: "H. Peter Anvin" Cc: Alain Knaff Cc: Albin Tonnerre Cc: Phillip Lougher Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds --- lib/decompress_inflate.c | 1 - 1 file changed, 1 deletion(-) (limited to 'lib/decompress_inflate.c') diff --git a/lib/decompress_inflate.c b/lib/decompress_inflate.c index 9a7f5dfc0ed7..b5fe1d1d5f05 100644 --- a/lib/decompress_inflate.c +++ b/lib/decompress_inflate.c @@ -19,7 +19,6 @@ #include "zlib_inflate/inflate.h" #include "zlib_inflate/infutil.h" -#include #endif /* STATIC */ -- cgit v1.2.2 From 1da914e0648ace34e1c3738d9584e8b2cd6fe64a Mon Sep 17 00:00:00 2001 From: Lasse Collin Date: Wed, 12 Jan 2011 17:01:25 -0800 Subject: decompressors: check input size in decompress_inflate.c Check for end of the input buffer when skipping over the filename field in the .gz file header. Signed-off-by: Lasse Collin Cc: "H. Peter Anvin" Cc: Alain Knaff Cc: Albin Tonnerre Cc: Phillip Lougher Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds --- lib/decompress_inflate.c | 17 +++++++++++++---- 1 file changed, 13 insertions(+), 4 deletions(-) (limited to 'lib/decompress_inflate.c') diff --git a/lib/decompress_inflate.c b/lib/decompress_inflate.c index b5fe1d1d5f05..19ff89e34eec 100644 --- a/lib/decompress_inflate.c +++ b/lib/decompress_inflate.c @@ -98,13 +98,22 @@ STATIC int INIT gunzip(unsigned char *buf, int len, * possible asciz filename) */ strm->next_in = zbuf + 10; + strm->avail_in = len - 10; /* skip over asciz filename */ if (zbuf[3] & 0x8) { - while (strm->next_in[0]) - strm->next_in++; - strm->next_in++; + do { + /* + * If the filename doesn't fit into the buffer, + * the file is very probably corrupt. Don't try + * to read more data. + */ + if (strm->avail_in == 0) { + error("header error"); + goto gunzip_5; + } + --strm->avail_in; + } while (*strm->next_in++); } - strm->avail_in = len - (strm->next_in - zbuf); strm->next_out = out_buf; strm->avail_out = out_len; -- cgit v1.2.2