[Xen-changelog] [xen master] bunzip2: off by one in get_next_block()

[patchbot@xxxxxxx]

commit 39798e95a954eec660a3f5f21489c30ef78daf6d
Author:     Dan Carpenter <dan.carpenter@xxxxxxxxxx>
AuthorDate: Wed Jan 28 16:50:08 2015 +0100
Commit:     Jan Beulich <jbeulich@xxxxxxxx>
CommitDate: Wed Jan 28 16:50:08 2015 +0100

    bunzip2: off by one in get_next_block()
    
    "origPtr" is used as an offset into the bd->dbuf[] array.  That array is
    allocated in start_bunzip() and has "bd->dbufSize" number of elements so
    the test here should be >= instead of >.
    
    Later we check "origPtr" again before using it as an offset so I don't
    know if this bug can be triggered in real life.
    
    Signed-off-by: Dan Carpenter <dan.carpenter@xxxxxxxxxx>
    
    Trivial adjustments to make the respective Linux commit
    b5c8afe5be51078a979d86ae5ae78c4ac948063d apply to Xen.
    
    Signed-off-by: Jan Beulich <jbeulich@xxxxxxxx>
    Acked-by: Ian Campbell <ian.campbell@xxxxxxxxxx>
---
 xen/common/bunzip2.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/xen/common/bunzip2.c b/xen/common/bunzip2.c
index 2eb70ab..6d6e8b1 100644
--- a/xen/common/bunzip2.c
+++ b/xen/common/bunzip2.c
@@ -174,7 +174,7 @@ static int INIT get_next_block(struct bunzip_data *bd)
        if (get_bits(bd, 1))
                return RETVAL_OBSOLETE_INPUT;
        origPtr = get_bits(bd, 24);
-       if (origPtr > dbufSize)
+       if (origPtr >= dbufSize)
                return RETVAL_DATA_ERROR;
        /* mapping table: if some byte values are never used (encoding things
           like ascii text), the compression code removes the gaps to have fewer
--
generated by git-patchbot for /home/xen/git/xen.git#master

_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxx
http://lists.xensource.com/xen-changelog