]> xenbits.xensource.com Git - xen.git/commit
bunzip2: off by one in get_next_block()
authorDan Carpenter <dan.carpenter@oracle.com>
Tue, 3 Feb 2015 14:30:13 +0000 (15:30 +0100)
committerJan Beulich <jbeulich@suse.com>
Tue, 3 Feb 2015 14:30:13 +0000 (15:30 +0100)
commitef73de2a84a3042c3481c9a521e8e0c756b793f2
tree83b1a42a298ce9ba63bd3c7615c93eb48dab6bd2
parent47266d66b35572b7d2f7b7a5f53d6eab05604cd2
bunzip2: off by one in get_next_block()

"origPtr" is used as an offset into the bd->dbuf[] array.  That array is
allocated in start_bunzip() and has "bd->dbufSize" number of elements so
the test here should be >= instead of >.

Later we check "origPtr" again before using it as an offset so I don't
know if this bug can be triggered in real life.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Trivial adjustments to make the respective Linux commit
b5c8afe5be51078a979d86ae5ae78c4ac948063d apply to Xen.

Signed-off-by: Jan Beulich <jbeulich@suse.com>
Acked-by: Ian Campbell <ian.campbell@citrix.com>
master commit: 39798e95a954eec660a3f5f21489c30ef78daf6d
master date: 2015-01-28 16:50:08 +0100
xen/common/bunzip2.c