c/mirror_zfs
1
0
Fork 0
mirror of https://git.proxmox.com/git/mirror_zfs.git synced 2025-03-11 22:13:10 +03:00
Code Issues Packages Projects Releases Wiki Activity

Fix zle_decompress out of bound access

Browse Source 
Reviewed-by: Brian Behlendorf <behlendorf1@llnl.gov>
Reviewed-by: loli10K <ezomori.nozomu@gmail.com>
Signed-off-by: Chunwei Chen <david.chen@nutanix.com>
Closes #7099
This commit is contained in:
Chunwei Chen 2018-02-01 15:41:05 -08:00 committed by Tony Hutter
parent 23227313a2
commit 5e566c5772
1 changed files with 4 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
module/zfs/zle.c
View File

@ -74,10 +74,14 @@ zle_decompress(void *s_start, void *d_start, size_t s_len, size_t d_len, int n)
while (src < s_end && dst < d_end) { while (src < s_end && dst < d_end) {
int len = 1 + *src++; int len = 1 + *src++;
if (len <= n) { if (len <= n) {
if (src + len > s_end || dst + len > d_end)
return (-1);
while (len-- != 0) while (len-- != 0)
*dst++ = *src++; *dst++ = *src++;
} else { } else {
len -= n; len -= n;
if (dst + len > d_end)
return (-1);
while (len-- != 0) while (len-- != 0)
*dst++ = 0; *dst++ = 0;
} }