diff options
Diffstat (limited to 'src')
| -rw-r--r-- | src/commonlib/bsd/lz4.c.inc | 1 | ||||
| -rw-r--r-- | src/commonlib/bsd/lz4_wrapper.c | 3 |
2 files changed, 4 insertions, 0 deletions
diff --git a/src/commonlib/bsd/lz4.c.inc b/src/commonlib/bsd/lz4.c.inc index b3be4e5b44..8c75e2f279 100644 --- a/src/commonlib/bsd/lz4.c.inc +++ b/src/commonlib/bsd/lz4.c.inc @@ -150,6 +150,7 @@ FORCE_INLINE int LZ4_decompress_generic( if ((length=(token>>ML_BITS)) == RUN_MASK) { unsigned s; + if ((endOnInput) && unlikely(ip>=iend-RUN_MASK)) goto _output_error; /* overflow detection */ do { s = *ip++; diff --git a/src/commonlib/bsd/lz4_wrapper.c b/src/commonlib/bsd/lz4_wrapper.c index 2367afceaf..3822e8c60f 100644 --- a/src/commonlib/bsd/lz4_wrapper.c +++ b/src/commonlib/bsd/lz4_wrapper.c @@ -129,6 +129,9 @@ size_t ulz4fn(const void *src, size_t srcn, void *dst, size_t dstn) } while (1) { + if ((size_t)(in - src) + sizeof(struct lz4_block_header) > srcn) + break; /* input overrun */ + struct lz4_block_header b = { { .raw = le32toh(*(const uint32_t *)in) } }; |