diff options
| author | Chunwei Chen <[email protected]> | 2018-02-01 15:41:05 -0800 |
|---|---|---|
| committer | Brian Behlendorf <[email protected]> | 2018-02-09 10:08:05 -0800 |
| commit | f108a49236ee21bab807c0c6750409b6912ef05e (patch) | |
| tree | fb22fce3702ff51534c96f5e219edfdf372bc577 /module/zfs/zle.c | |
| parent | d3190c5f2914b7265f130dc44b868634877a8d7e (diff) | |
Fix zle_decompress out of bound access
Reviewed-by: Brian Behlendorf <[email protected]>
Reviewed-by: loli10K <[email protected]>
Signed-off-by: Chunwei Chen <[email protected]>
Closes #7099
Diffstat (limited to 'module/zfs/zle.c')
| -rw-r--r-- | module/zfs/zle.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/module/zfs/zle.c b/module/zfs/zle.c index 13c5673fb..613607faa 100644 --- a/module/zfs/zle.c +++ b/module/zfs/zle.c @@ -74,10 +74,14 @@ zle_decompress(void *s_start, void *d_start, size_t s_len, size_t d_len, int n) while (src < s_end && dst < d_end) { int len = 1 + *src++; if (len <= n) { + if (src + len > s_end || dst + len > d_end) + return (-1); while (len-- != 0) *dst++ = *src++; } else { len -= n; + if (dst + len > d_end) + return (-1); while (len-- != 0) *dst++ = 0; } |