emo/busybox
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix for an integer overflow bug that could cause a segfault on certain

Browse Source 
pathological archives.

(Unlikely to have security implications, the only way to trigger it basically
wound up doing memset(dbuf,x,2^31) and triggering an immediate segfault.  The
test basically gives us a more polite error message.)

Thanks to Ned Ludd and the Gentoo security guys for finding this.
This commit is contained in:
Rob Landley 2006-02-17 05:19:40 +00:00
parent 2c98c40ec8
commit efae294b15
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
archival/libunarchive/decompress_bunzip2.c
View File

@ -413,7 +413,7 @@ got_huff_bits:
context). Thus space is saved. */ context). Thus space is saved. */
t += (runPos << nextSym); /* +runPos if RUNA; +2*runPos if RUNB */ t += (runPos << nextSym); /* +runPos if RUNA; +2*runPos if RUNB */
runPos <<= 1; if(runPos < dbufSize) runPos <<= 1;
goto end_of_huffman_loop; goto end_of_huffman_loop;
} }