RepoMirrors/btrfs-progs
1
0
Fork 0
mirror of https://github.com/kdave/btrfs-progs synced 2025-01-11 16:29:42 +00:00
Code Issues Packages Projects Releases Wiki Activity

btrfs-progs: restore: check lzo compress length

Browse Source 
When things go wrong for lzo-compressed btrfs, feeding lzo1x_decompress_safe()
with corrupt data during restore can lead to crashes. Reduce the risk by adding
a check on the input length.

Signed-off-by: Vincent Stehlé <vincent.stehle@laposte.net>
Signed-off-by: David Sterba <dsterba@suse.cz>
This commit is contained in:
Vincent Stehlé 2014-06-18 18:51:19 +02:00 committed by David Sterba
parent f8c6dabca5
commit 93ebec96f2
1 changed files with 6 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
cmds-restore.c
View File

@ -115,6 +115,12 @@ static int decompress_lzo(unsigned char *inbuf, char *outbuf, u64 compress_len,
while (tot_in < tot_len) {
in_len = read_compress_length(inbuf);
if ((tot_in + LZO_LEN + in_len) > tot_len) {
fprintf(stderr, "bad compress length %lu\n", in_len);
return -1;
}
inbuf += LZO_LEN;
tot_in += LZO_LEN;