decompress_bunzip2: off by one in get_next_block()

PATCH New Dan Carpenter 1 participant 1 message Oct 22, 2014

Subsystems (2)

Kernel janitors Library code

lore

Share & tools

lore

Dan Carpenter

author

2014-10-22 08:16 UTC #0 lore raw

PATCH 1/1 decompress_bunzip2: off by one in get_next_block()

"origPtr" is used as an offset into the bd->dbuf[] array. That array is allocated in start_bunzip() and has "bd->dbufSize" number of elements so the test here should be >= instead of >.

Later we check "origPtr" again before using it as an offset so I don't know if this bug can be triggered in real life.

Fixes bc22c17e12c1 ('bzip2/lzma: library support for gzip, bzip2 and lzma decompression')

Signed-off-by Dan Carpenter <[email protected]>

lib/decompress_bunzip2.c +1 -1

index 8290e0b..6dd0335 100644
@@ -184,7 +184,7 @@ static int INIT get_next_block(struct bunzip_data *bd)
 	if (get_bits(bd, 1))
 		return RETVAL_OBSOLETE_INPUT;
 	origPtr = get_bits(bd, 24);
-	if (origPtr > dbufSize)
+	if (origPtr >= dbufSize)
 		return RETVAL_DATA_ERROR;
 	/* mapping table: if some byte values are never used (encoding things
 	   like ascii text), the compression code removes the gaps to have fewer