diff options
| author | Daniel Vetter <daniel.vetter@ffwll.ch> | 2015-03-30 16:37:08 +0200 |
|---|---|---|
| committer | Daniel Vetter <daniel.vetter@ffwll.ch> | 2015-03-30 16:37:08 +0200 |
| commit | 6e0aa8018f9c676b115b7ca6c20a056fc57c68a9 (patch) | |
| tree | b35393574b48dcc05c99599add7f8b0015de3913 /lib | |
| parent | 1ff27a3443addb19af609245b218fa510c7d37dd (diff) | |
| parent | e42391cd048809d903291d07f86ed3934ce138e9 (diff) | |
Merge tag 'v4.0-rc6' into drm-intel-next
Backmerge Linux 4.0-rc6 because conflicts are (again) getting out of
hand. To make sure we don't lose any bugfixes from the 4.0-rc5-rc6
flurry of patches we've applied them all to -next too.
Conflicts:
drivers/gpu/drm/i915/intel_display.c
Always take the version from -next, we've already handled all
conflicts with explicit cherrypicking.
Signed-off-by: Daniel Vetter <daniel.vetter@intel.com>
Diffstat (limited to 'lib')
| -rw-r--r-- | lib/lz4/lz4_decompress.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/lib/lz4/lz4_decompress.c b/lib/lz4/lz4_decompress.c index 7a85967060a5..f0f5c5c3de12 100644 --- a/lib/lz4/lz4_decompress.c +++ b/lib/lz4/lz4_decompress.c @@ -139,6 +139,9 @@ static int lz4_uncompress(const char *source, char *dest, int osize) /* Error: request to write beyond destination buffer */ if (cpy > oend) goto _output_error; + if ((ref + COPYLENGTH) > oend || + (op + COPYLENGTH) > oend) + goto _output_error; LZ4_SECURECOPY(ref, op, (oend - COPYLENGTH)); while (op < cpy) *op++ = *ref++; |