From 4d3b8a0d1b8665c190d502744e753ba05a047810 Mon Sep 17 00:00:00 2001 From: Antonios Vamporakis Date: Tue, 31 Dec 2013 02:57:01 +0100 Subject: lzma: fix buffer bound check error Variable uncompressedSize references the space available, while outSizeFull is the actual expected uncompressed size. Using the wrong value causes LzmaDecode to return SZ_ERROR_INPUT_EOF. Problem was introduced in commit afca294. While at it add additional debug message. Signed-off-by: Antonios Vamporakis CC: Kees Cook CC: Simon Glass CC: Daniel Schwierzeck CC: Luka Perkov --- lib/lzma/LzmaTools.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) (limited to 'lib') diff --git a/lib/lzma/LzmaTools.c b/lib/lzma/LzmaTools.c index 0aec2f9c76..90d31cdcf8 100644 --- a/lib/lzma/LzmaTools.c +++ b/lib/lzma/LzmaTools.c @@ -102,7 +102,7 @@ int lzmaBuffToBuffDecompress (unsigned char *outStream, SizeT *uncompressedSize, return SZ_ERROR_OUTPUT_EOF; /* Decompress */ - outProcessed = *uncompressedSize; + outProcessed = outSizeFull; WATCHDOG_RESET(); @@ -111,6 +111,9 @@ int lzmaBuffToBuffDecompress (unsigned char *outStream, SizeT *uncompressedSize, inStream + LZMA_DATA_OFFSET, &compressedSize, inStream, LZMA_PROPS_SIZE, LZMA_FINISH_END, &state, &g_Alloc); *uncompressedSize = outProcessed; + + debug("LZMA: Uncompresed ................ 0x%zx\n", outProcessed); + if (res != SZ_OK) { return res; } -- cgit v1.2.1