Module Name: src
Committed By: snj
Date: Wed Sep 22 23:08:01 UTC 2010
Modified Files:
src/dist/bzip2 [netbsd-4]: decompress.c
Log Message:
Pull up following revision(s) (requested by christos in ticket #1406):
dist/bzip2/decompress.c: revision 1.2
avoid integer overflow that can lead to buffer overflow
To generate a diff of this commit:
cvs rdiff -u -r1.1.1.2.18.1 -r1.1.1.2.18.2 src/dist/bzip2/decompress.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: src/dist/bzip2/decompress.c
diff -u src/dist/bzip2/decompress.c:1.1.1.2.18.1 src/dist/bzip2/decompress.c:1.1.1.2.18.2
--- src/dist/bzip2/decompress.c:1.1.1.2.18.1 Mon Mar 24 20:22:35 2008
+++ src/dist/bzip2/decompress.c Wed Sep 22 23:08:01 2010
@@ -381,6 +381,13 @@
es = -1;
N = 1;
do {
+ /* Check that N doesn't get too big, so that es doesn't
+ go negative. The maximum value that can be
+ RUNA/RUNB encoded is equal to the block size (post
+ the initial RLE), viz, 900k, so bounding N at 2
+ million should guard against overflow without
+ rejecting any legitimate inputs. */
+ if (N >= 2*1024*1024) RETURN(BZ_DATA_ERROR);
if (nextSym == BZ_RUNA) es = es + (0+1) * N; else
if (nextSym == BZ_RUNB) es = es + (1+1) * N;
N = N * 2;
