aboutsummaryrefslogtreecommitdiff
path: root/toys/other
diff options
context:
space:
mode:
authorRob Landley <rob@landley.net>2016-03-03 11:07:59 -0600
committerRob Landley <rob@landley.net>2016-03-03 11:07:59 -0600
commit5ad93f32da3e2ac70b1fa929889d3034c79f7ed6 (patch)
tree17282509612347465b14e233513691a707190296 /toys/other
parentffc6fbbde3eeca29d1eb3470610eb7ae5b9025f1 (diff)
downloadtoybox-5ad93f32da3e2ac70b1fa929889d3034c79f7ed6.tar.gz
Fix bzcat integer overflow reported by John Regehr.
Diffstat (limited to 'toys/other')
-rw-r--r--toys/other/bzcat.c8
1 files changed, 5 insertions, 3 deletions
diff --git a/toys/other/bzcat.c b/toys/other/bzcat.c
index 1081b5e9..fdad9a01 100644
--- a/toys/other/bzcat.c
+++ b/toys/other/bzcat.c
@@ -319,9 +319,9 @@ static int read_block_header(struct bunzip_data *bd, struct bwdata *bw)
static int read_huffman_data(struct bunzip_data *bd, struct bwdata *bw)
{
struct group_data *hufGroup;
- int hh, ii, jj, kk, runPos, dbufCount, symCount, selector, nextSym,
+ int ii, jj, kk, runPos, dbufCount, symCount, selector, nextSym,
*byteCount, *base, *limit;
- unsigned int *dbuf = bw->dbuf;
+ unsigned hh, *dbuf = bw->dbuf;
unsigned char uc;
// We've finished reading and digesting the block header. Now read this
@@ -401,7 +401,9 @@ static int read_huffman_data(struct bunzip_data *bd, struct bwdata *bw)
literal used is the one at the head of the mtfSymbol array.) */
if (runPos) {
runPos = 0;
- if (dbufCount+hh > bd->dbufSize) return RETVAL_DATA_ERROR;
+ // Check for integer overflow
+ if (hh>bd->dbufSize || dbufCount+hh>bd->dbufSize)
+ return RETVAL_DATA_ERROR;
uc = bd->symToByte[bd->mtfSymbol[0]];
byteCount[uc] += hh;