Commit 4d3b8a0d1b8665c190d502744e753ba05a047810
lzma: fix buffer bound check error
Variable uncompressedSize references the space available, while outSizeFull is the actual expected uncompressed size. Using the wrong value causes LzmaDecode to return SZ_ERROR_INPUT_EOF. Problem was introduced in commit afca294. While at it add additional debug message. Signed-off-by: Antonios Vamporakis <ant@area128.com> CC: Kees Cook <keescook@chromium.org> CC: Simon Glass <sjg@chromium.org> CC: Daniel Schwierzeck <daniel.schwierzeck@gmail.com> CC: Luka Perkov <luka@openwrt.org>
Showing 1 changed file with 4 additions and 1 deletions Side-by-side Diff
... | ... | @@ -102,7 +102,7 @@ |
102 | 102 | return SZ_ERROR_OUTPUT_EOF; |
103 | 103 | |
104 | 104 | /* Decompress */ |
105 | - outProcessed = *uncompressedSize; | |
105 | + outProcessed = outSizeFull; | |
106 | 106 | |
107 | 107 | WATCHDOG_RESET(); |
108 | 108 | |
... | ... | @@ -111,6 +111,9 @@ |
111 | 111 | inStream + LZMA_DATA_OFFSET, &compressedSize, |
112 | 112 | inStream, LZMA_PROPS_SIZE, LZMA_FINISH_END, &state, &g_Alloc); |
113 | 113 | *uncompressedSize = outProcessed; |
114 | + | |
115 | + debug("LZMA: Uncompresed ................ 0x%zx\n", outProcessed); | |
116 | + | |
114 | 117 | if (res != SZ_OK) { |
115 | 118 | return res; |
116 | 119 | } |
-
mentioned in commit f6eec8
-
mentioned in commit f6eec8
-
mentioned in commit f6eec8
-
mentioned in commit f6eec8
-
mentioned in commit f6eec8
-
mentioned in commit f6eec8
-
mentioned in commit f6eec8
-
mentioned in commit f6eec8
-
mentioned in commit f6eec8
-
mentioned in commit f6eec8
-
mentioned in commit f6eec8
-
mentioned in commit f6eec8
-
mentioned in commit f6eec8
-
mentioned in commit f6eec8
-
mentioned in commit f6eec8
-
mentioned in commit f6eec8
-
mentioned in commit f6eec8
-
mentioned in commit f6eec8
-
mentioned in commit f6eec8
-
mentioned in commit f6eec8
-
mentioned in commit f6eec8
-
mentioned in commit f6eec8
-
mentioned in commit f6eec8
-
mentioned in commit f6eec8
-
mentioned in commit f6eec8
-
mentioned in commit f6eec8
-
mentioned in commit f6eec8
-
mentioned in commit f6eec8
-
mentioned in commit f6eec8
-
mentioned in commit f6eec8
-
mentioned in commit f6eec8
-
mentioned in commit f6eec8
-
mentioned in commit f6eec8
-
mentioned in commit f6eec8
-
mentioned in commit f6eec8
-
mentioned in commit f6eec8
-
mentioned in commit f6eec8
-
mentioned in commit f6eec8
-
mentioned in commit f6eec8
-
mentioned in commit f6eec8
-
mentioned in commit f6eec8
-
mentioned in commit f6eec8
-
mentioned in commit f6eec8