| From 8301a21773ef61656225e264f4f06ae14462bca7 Mon Sep 17 00:00:00 2001 |
| From: Jasper Lievisse Adriaanse <j@jasper.la> |
| Date: Fri, 26 Feb 2021 15:21:20 +0100 |
| Subject: [PATCH] Fix potential memory corruption with negative memmove() size |
| |
| Upstream-Status: Backport |
| https://github.com/lz4/lz4/commit/8301a21773ef61656225e264f4f06ae14462bca7#diff-7055e9cf14c488aea9837aaf9f528b58ee3c22988d7d0d81d172ec62d94a88a7 |
| CVE: CVE-2021-3520 |
| Signed-off-by: Armin Kuster <akuster@mvista.com> |
| |
| --- |
| lib/lz4.c | 2 +- |
| 1 file changed, 1 insertion(+), 1 deletion(-) |
| |
| Index: git/lib/lz4.c |
| =================================================================== |
| --- git.orig/lib/lz4.c |
| +++ git/lib/lz4.c |
| @@ -1665,7 +1665,7 @@ LZ4_decompress_generic( |
| const size_t dictSize /* note : = 0 if noDict */ |
| ) |
| { |
| - if (src == NULL) { return -1; } |
| + if ((src == NULL) || (outputSize < 0)) { return -1; } |
| |
| { const BYTE* ip = (const BYTE*) src; |
| const BYTE* const iend = ip + srcSize; |