Messages in this thread Patch in this message | | | Subject | [PATCH] Decompressors: Check input size in decompress_inflate.c | From | Lasse Collin <> | Date | Fri, 26 Nov 2010 20:23:43 +0200 |
| |
From: Lasse Collin <lasse.collin@tukaani.org>
Check for end of the input buffer when skipping over the filename field in the .gz file header.
Signed-off-by: Lasse Collin <lasse.collin@tukaani.org> ---
diff -uprN linux-2.6.37-rc3.orig/lib/decompress_inflate.c linux-2.6.37-rc3/lib/decompress_inflate.c --- linux-2.6.37-rc3.orig/lib/decompress_inflate.c 2010-10-20 23:30:22.000000000 +0300 +++ linux-2.6.37-rc3/lib/decompress_inflate.c 2010-11-26 19:42:15.000000000 +0200 @@ -100,13 +100,22 @@ STATIC int INIT gunzip(unsigned char *bu * possible asciz filename) */ strm->next_in = zbuf + 10; + strm->avail_in = len - 10; /* skip over asciz filename */ if (zbuf[3] & 0x8) { - while (strm->next_in[0]) - strm->next_in++; - strm->next_in++; + do { + /* + * If the filename doesn't fit into the buffer, + * the file is very probably corrupt. Don't try + * to read more data. + */ + if (strm->avail_in == 0) { + error("header error"); + goto gunzip_5; + } + --strm->avail_in; + } while (*strm->next_in++); } - strm->avail_in = len - (strm->next_in - zbuf); strm->next_out = out_buf; strm->avail_out = out_len;
| |