From 8220e5ba0272a6f5eb8434314ed896987743a837 Mon Sep 17 00:00:00 2001 From: Gabor Juhos Date: Thu, 19 Apr 2012 21:31:40 +0000 Subject: [PATCH] ar71xx: add sanity checks to decode_rle Also use -EINVAL instead of -1. SVN-Revision: 31353 --- target/linux/ar71xx/files/arch/mips/ath79/mach-rb750.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/target/linux/ar71xx/files/arch/mips/ath79/mach-rb750.c b/target/linux/ar71xx/files/arch/mips/ath79/mach-rb750.c index 3e4a5527f8..30d8eac796 100644 --- a/target/linux/ar71xx/files/arch/mips/ath79/mach-rb750.c +++ b/target/linux/ar71xx/files/arch/mips/ath79/mach-rb750.c @@ -299,24 +299,29 @@ static int decode_rle(char *output, int len, char *in) { char *ptr = output; char *end = output + len; + + if (!output || !in) + return -EINVAL; + while (*in) { if (*in < 0) { int i = -*in++; while (i-- > 0) { if (ptr >= end) - return -1; + return -EINVAL; *ptr++ = *in++; } } else if (*in > 0) { int i = *in++; while (i-- > 0) { if (ptr >= end) - return -1; + return -EINVAL; *ptr++ = *in; } in++; } } + return ptr - output; } -- 2.30.2