lzma: fix buffer bound check error further
authorSimon Glass <sjg@chromium.org>
Tue, 2 Dec 2014 20:17:29 +0000 (13:17 -0700)
committerTom Rini <trini@ti.com>
Wed, 14 Jan 2015 16:35:43 +0000 (11:35 -0500)
commitf6eec89fa30009aabac081158e36364dc025a3a4
treea37c863b7426f302638db92fa06879a12281be0c
parent95099fee404024d3f150827da755b7b487be5ba8
lzma: fix buffer bound check error further

Commit 4d3b8a0d fixed a problem with lzma decompress where it would
run out of bytes to decompress. The algorithm needs to know how many
uncompressed bytes it is expected to produce.

However, the fix introduced a potential buffer overrun, and causes
the compression test to fail (test_compression command in sandbox).

The correct fix seems to be to use the minimum of the expected number
of uncompressed bytes and the amount of output space available. That
way things work normally when there is enough space, and return an
error (without overrunning available space) when there is not.

Signed-off-by: Antonios Vamporakis <ant@area128.com>
CC: Kees Cook <keescook@chromium.org>
CC: Simon Glass <sjg@chromium.org>
CC: Daniel Schwierzeck <daniel.schwierzeck@gmail.com>
CC: Luka Perkov <luka@openwrt.org>
Signed-off-by: Simon Glass <sjg@chromium.org>
lib/lzma/LzmaTools.c