aboutsummaryrefslogtreecommitdiffstats
path: root/arch/h8300
diff options
context:
space:
mode:
authorVolodymyr G. Lukiianyk <volodymyrgl@gmail.com>2008-10-15 22:01:15 -0700
committerLinus Torvalds <torvalds@linux-foundation.org>2008-10-16 11:21:29 -0700
commitf4cfb18d7917ecb397b3497e931a2a23175709b7 (patch)
treebb891b0f478e2ed7fa9dcefacc0b8342ce1b43d6 /arch/h8300
parent0c6aa2639ea83bfb7f91d72118bad70b3f60012a (diff)
uclinux: fix gzip header parsing in binfmt_flat.c
There are off-by-one errors in decompress_exec() when calculating the length of optional "original file name" and "comment" fields: the "ret" index is not incremented when terminating '\0' character is reached. The check of the buffer overflow (after an "extra-field" length was taken into account) is also fixed. I've encountered this off-by-one error when tried to reuse gzip-header-parsing part of the decompress_exec() function. There was an "original file name" field in the payload (with miscalculated length) and zlib_inflate() returned Z_DATA_ERROR. But after the fix similar to this one all worked fine. Signed-off-by: Volodymyr G Lukiianyk <volodymyrgl@gmail.com> Acked-by: Greg Ungerer <gerg@snapgear.com> Acked-by: David Howells <dhowells@redhat.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Diffstat (limited to 'arch/h8300')
0 files changed, 0 insertions, 0 deletions

Privacy Policy