diff options
author | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2014-07-03 12:48:59 -0700 |
---|---|---|
committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2014-07-03 12:48:59 -0700 |
commit | 868b60e0550247fc83630070ff64bbfb803b2347 (patch) | |
tree | 1467d993b4923ed0e4f77fc5ab8c81e23f0d533b /lib/lz4/lz4_decompress.c | |
parent | c9d53c0f2d23c792e4b9cf1551b63de4516f839e (diff) | |
parent | 6955b58254c2bcee8a7b55ce06468a645dc98ec5 (diff) | |
download | talos-op-linux-868b60e0550247fc83630070ff64bbfb803b2347.tar.gz talos-op-linux-868b60e0550247fc83630070ff64bbfb803b2347.zip |
Merge branch 'component-for-driver' of git://ftp.arm.linux.org.uk/~rmk/linux-arm into driver-core-next
Russell writes:
These updates fix one bug in the component helper where the matched
components are not properly cleaned up when the master fails to bind.
I'll provide a version of this for stable trees if it's deemed that
we need to backport it.
The second patch causes the component helper to ignore duplicate
matches when adding components - this is something that was originally
needed for imx-drm, but since that has now been updated, we no longer
need to skip over a component which has already been matched.
The final patch starts the process of updating the component helper
API to achieve two goals: to allow the API to be more efficient when
deferred probing occurs, and to allow for future improvements to the
component helper without having a major impact on the users.
This represents groundwork for some other changes; once this has been
merged, I will then send two further pull requests (one for the staging
tree, and one for the DRM tree) to update the drivers to the new API.
This will result in these three commits being shared with those trees.
Diffstat (limited to 'lib/lz4/lz4_decompress.c')
-rw-r--r-- | lib/lz4/lz4_decompress.c | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/lib/lz4/lz4_decompress.c b/lib/lz4/lz4_decompress.c index df6839e3ce08..b74da447e81e 100644 --- a/lib/lz4/lz4_decompress.c +++ b/lib/lz4/lz4_decompress.c @@ -72,6 +72,8 @@ static int lz4_uncompress(const char *source, char *dest, int osize) len = *ip++; for (; len == 255; length += 255) len = *ip++; + if (unlikely(length > (size_t)(length + len))) + goto _output_error; length += len; } @@ -106,6 +108,8 @@ static int lz4_uncompress(const char *source, char *dest, int osize) if (length == ML_MASK) { for (; *ip == 255; length += 255) ip++; + if (unlikely(length > (size_t)(length + *ip))) + goto _output_error; length += *ip++; } @@ -155,7 +159,7 @@ static int lz4_uncompress(const char *source, char *dest, int osize) /* write overflow error detected */ _output_error: - return (int) (-(((char *)ip) - source)); + return -1; } static int lz4_uncompress_unknownoutputsize(const char *source, char *dest, |