lz4: ensure length does not wrap
authorGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Sat, 21 Jun 2014 05:01:41 +0000 (22:01 -0700)
committerSri Krishna chowdary <schowdary@nvidia.com>
Tue, 2 Dec 2014 05:44:07 +0000 (10:44 +0530)
commit50920a6b3424569c243d3e2810e1955d527a11db
treef6850a5e1f9729a98c4a876b5d8b6ea94785e699
parentd881207b71d4d0113bd9a08a49e2de1559f4bc14
lz4: ensure length does not wrap

Given some pathologically compressed data, lz4 could possibly decide to
wrap a few internal variables, causing unknown things to happen.  Catch
this before the wrapping happens and abort the decompression.

Bug 200057240

Reported-by: "Don A. Bailey" <donb@securitymouse.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Change-Id: Ib0a4785ea40c9cf2e2dec14eec3dd9f3f610aa64
(cherry picked from commit 206204a1162b995e2185275167b22468c00d6b36)
Signed-off-by: Sri Krishna chowdary <schowdary@nvidia.com>
lib/lz4/lz4_decompress.c