Home » Mailing list archives » linux-kernel » 2008 » August » 26

[PATCH] uclinux: fix gzip header parsing in binfmt_flat.c

Previous message: [thread] [date] [author]
Next message: [thread] [date] [author]
[view in full thread]
From: Volodymyr G. Lukiianyk
Subject: [PATCH] uclinux: fix gzip header parsing in binfmt_flat.c
Date: Tuesday, August 26, 2008 - 10:52 am

There are off-by-one errors in decompress_exec() when calculating the length of
optional "original file name" and "comment" fields: the "ret" index is not
incremented when terminating '\0' character is reached. The check of the buffer
overflow (after an "extra-field" length was taken into account) is also fixed.

Signed-off-by: Volodymyr G Lukiianyk <volodymyrgl@gmail.com>
---

I've encountered this off-by-one error when tried to reuse gzip-header-parsing
part of the decompress_exec() function. There was an "original file name" field
in the payload (with miscalculated length) and zlib_inflate() returned
Z_DATA_ERROR. But after the fix similar to this one all worked fine.

WARNING: the proposed patch wasn't properly tested.
Previous message: [thread] [date] [author]
Next message: [thread] [date] [author]
Messages in current thread:
[PATCH] uclinux: fix gzip header parsing in binfmt_flat.c, Volodymyr G. Lukiianyk, (Tue Aug 26, 10:52 am)
Re: [PATCH] uclinux: fix gzip header parsing in binfmt_flat.c, Volodymyr G. Lukiianyk, (Tue Aug 26, 10:57 am)