Dan Carpenter 42ddd03e80 decompress_bunzip2: off by one in get_next_block() ...

commit b5c8afe5be upstream.

"origPtr" is used as an offset into the bd->dbuf[] array.  That array is
allocated in start_bunzip() and has "bd->dbufSize" number of elements so
the test here should be >= instead of >.

Later we check "origPtr" again before using it as an offset so I don't
know if this bug can be triggered in real life.

Fixes: bc22c17e12 ('bzip2/lzma: library support for gzip, bzip2 and lzma decompression')
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Cc: Alain Knaff <alain@knaff.lu>
Cc: Yinghai Lu <yinghai@kernel.org>
Cc: "H. Peter Anvin" <hpa@zytor.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2015-01-27 07:52:33 -08:00

..

lzo

lzo: check for length overrun in variable length encoding.

2014-10-30 09:35:11 -07:00

mpi

lib/mpi/mpicoder.c: looping issue, need stop when equal to zero, found by 'EXTRA_FLAGS=-W'.

2013-06-12 16:29:44 -07:00

raid6

lib/raid6: build proper files on corresponding arch

2012-12-13 19:51:04 +11:00

reed_solomon

…

xz

decompressors: fix typo "POWERPC"

2013-03-13 15:21:48 -07:00

zlib_deflate

…

zlib_inflate

…

.gitignore

X.509: Implement simple static OID registry

2012-10-08 13:50:18 +10:30

argv_split.c

argv_split(): teach it to handle mutable strings

2013-04-29 18:28:19 -07:00

asn1_decoder.c

Merge tag 'modules-next-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rusty/linux

2012-12-19 07:55:08 -08:00

atomic64_test.c

atomic64_test: simplify the #ifdef for atomic64_dec_if_positive() test

2012-07-30 17:25:16 -07:00

atomic64.c

lib: atomic64: Initialize locks statically to fix early users

2012-12-20 13:50:16 -08:00

audit.c

…

average.c

lib: reduce the use of module.h wherever possible

2012-03-07 15:04:04 -05:00

bcd.c

usb/core: use bin2bcd() for bcdDevice in RH

2012-09-10 11:13:16 -07:00

bch.c

…

bitmap.c

lib/bitmap.c: fix undefined shift in __bitmap_shift_{left|right}()

2014-11-14 08:47:59 -08:00

bitrev.c

…

bsearch.c

lib: reduce the use of module.h wherever possible

2012-03-07 15:04:04 -05:00

btree.c

lib/btree.c: fix leak of whole btree nodes

2014-08-07 14:30:27 -07:00

bug.c

taint: add explicit flag to show whether lock dep is still OK.

2013-01-21 17:17:57 +10:30

build_OID_registry

X.509: Implement simple static OID registry

2012-10-08 13:50:18 +10:30

bust_spinlocks.c

printk: Provide a wake_up_klogd() off-case

2013-03-22 16:41:20 -07:00

check_signature.c

lib: reduce the use of module.h wherever possible

2012-03-07 15:04:04 -05:00

checksum.c

asm-generic headers: Allow yet more arch overrides in checksum.h

2013-02-11 20:00:33 +05:30

clz_tab.c

lib: Fix multiple definitions of clz_tab

2012-02-02 10:34:23 +11:00

cmdline.c

lib: reduce the use of module.h wherever possible

2012-03-07 15:04:04 -05:00

cordic.c

Docs: wording: functions -> algorithm

2011-10-29 21:20:22 +02:00

cpu_rmap.c

lib: cpu_rmap: avoid flushing all workqueues

2013-01-11 14:54:54 -08:00

cpu-notifier-error-inject.c

cpu: rewrite cpu-notifier-error-inject module

2012-07-30 17:25:22 -07:00

cpumask.c

bootmem: fix wrong call parameter for free_bootmem()

2012-12-11 17:22:28 -08:00

crc7.c

…

crc8.c

lib: crc8: add new library module providing crc8 algorithm

2011-06-03 15:01:06 -04:00

crc16.c

…

crc32.c

sections: fix const sections for crc32 table

2012-10-06 03:04:46 +09:00

crc32defs.h

crc32: select an algorithm via Kconfig

2012-03-23 16:58:38 -07:00

crc-ccitt.c

…

crc-itu-t.c

…

crc-t10dif.c

…

ctype.c

lib: reduce the use of module.h wherever possible

2012-03-07 15:04:04 -05:00

debug_locks.c

lib: reduce the use of module.h wherever possible

2012-03-07 15:04:04 -05:00

debugobjects.c

hlist: drop the node parameter from iterators

2013-02-27 19:10:24 -08:00

dec_and_lock.c

lib: reduce the use of module.h wherever possible

2012-03-07 15:04:04 -05:00

decompress_bunzip2.c

decompress_bunzip2: off by one in get_next_block()

2015-01-27 07:52:33 -08:00

decompress_inflate.c

lib/decompressors: fix "no limit" output buffer length

2014-02-06 11:08:12 -08:00

decompress_unlzma.c

treewide: Fix comment and string typo 'bufer'

2011-12-06 09:53:40 +01:00

decompress_unlzo.c

lib/lzo: Rename lzo1x_decompress.c to lzo1x_decompress_safe.c

2013-02-20 19:36:00 +01:00

decompress_unxz.c

…

decompress.c

lib/decompress.c: fix initconst

2013-04-30 17:04:09 -07:00

devres.c

lib/devres.c: fix misplaced #endif

2013-02-27 19:10:09 -08:00

digsig.c

Merge branch 'next' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security

2013-02-21 08:18:12 -08:00

div64.c

Revert "math64: New div64_u64_rem helper"

2013-04-30 19:13:05 +02:00

dma-debug.c

dma-debug: update DMA debug API to better handle multiple mappings of a buffer

2013-03-22 16:41:20 -07:00

dump_stack.c

dump_stack: consolidate dump_stack() implementations and unify their behaviors

2013-04-30 17:04:02 -07:00

dynamic_debug.c

dynamic_debug: reuse generic string_unescape function

2013-04-30 17:04:03 -07:00

dynamic_queue_limits.c

bql: Avoid possible inconsistent calculation.

2012-05-31 18:18:17 -04:00

earlycpio.c

lib: Add early cpio decoder

2012-09-30 18:02:20 -07:00

extable.c

…

fault-inject.c

lib/: rename random32() to prandom_u32()

2013-04-29 18:28:42 -07:00

fdt_ro.c

of/lib: Allow scripts/dtc/libfdt to be used from kernel code

2012-07-23 13:54:52 +01:00

fdt_rw.c

of/lib: Allow scripts/dtc/libfdt to be used from kernel code

2012-07-23 13:54:52 +01:00

fdt_strerror.c

of/lib: Allow scripts/dtc/libfdt to be used from kernel code

2012-07-23 13:54:52 +01:00

fdt_sw.c

of/lib: Allow scripts/dtc/libfdt to be used from kernel code

2012-07-23 13:54:52 +01:00

fdt_wip.c

of/lib: Allow scripts/dtc/libfdt to be used from kernel code

2012-07-23 13:54:52 +01:00

fdt.c

of/lib: Allow scripts/dtc/libfdt to be used from kernel code

2012-07-23 13:54:52 +01:00

find_last_bit.c

lib: reduce the use of module.h wherever possible

2012-03-07 15:04:04 -05:00

find_next_bit.c

lib: reduce the use of module.h wherever possible

2012-03-07 15:04:04 -05:00

flex_array.c

lib: reduce the use of module.h wherever possible

2012-03-07 15:04:04 -05:00

flex_proportions.c

lib/flex_proportions.c: fix corruption of denominator in flexible proportions

2012-09-25 08:59:21 -07:00

gcd.c

lib/gcd.c: prevent possible div by 0

2012-10-06 03:04:57 +09:00

gen_crc32table.c

sections: fix const sections for crc32 table

2012-10-06 03:04:46 +09:00

genalloc.c

lib/genalloc.c: fix overflow of ending address of memory chunk

2013-12-11 22:36:28 -08:00

halfmd4.c

lib: reduce the use of module.h wherever possible

2012-03-07 15:04:04 -05:00

hexdump.c

dynamic_debug: dynamic hex dump

2013-01-17 12:19:09 -08:00

hweight.c

lib: reduce the use of module.h wherever possible

2012-03-07 15:04:04 -05:00

idr.c

idr: fix overflow bug during maximum ID calculation at maximum height

2014-06-30 20:09:42 -07:00

inflate.c

…

int_sqrt.c

lib/int_sqrt.c: optimize square root algorithm

2013-04-29 18:28:19 -07:00

interval_tree_test_main.c

random32: rename random32 to prandom

2012-12-17 17:15:26 -08:00

interval_tree.c

mm: interval tree updates

2012-10-09 16:22:40 +09:00

iomap_copy.c

lib: reduce the use of module.h wherever possible

2012-03-07 15:04:04 -05:00

iomap.c

lib: reduce the use of module.h wherever possible

2012-03-07 15:04:04 -05:00

iommu-helper.c

Merge tag 'module-for-3.4' of git://git.kernel.org/pub/scm/linux/kernel/git/paulg/linux

2012-03-24 10:24:31 -07:00

ioremap.c

lib: reduce the use of module.h wherever possible

2012-03-07 15:04:04 -05:00

iovec.c

Hoist memcpy_fromiovec/memcpy_toiovec into lib/

2013-05-20 10:24:22 +09:30

irq_regs.c

lib: reduce the use of module.h wherever possible

2012-03-07 15:04:04 -05:00

is_single_threaded.c

…

jedec_ddr_data.c

ddr: add LPDDR2 data from JESD209-2

2012-05-02 00:04:06 -07:00

kasprintf.c

lib/kasprintf.c: use kmalloc_track_caller() to get accurate traces for kvasprintf

2012-10-11 08:50:15 +09:00

Kconfig

Move utf16 functions to kernel core and rename

2013-04-15 21:23:03 +01:00

Kconfig.debug

lib/Kconfig.debug: Restrict FRAME_POINTER for MIPS

2013-07-28 16:30:12 -07:00

Kconfig.kgdb

Merge tag 'for_linux-3.9' of git://git.kernel.org/pub/scm/linux/kernel/git/jwessel/kgdb

2013-03-02 08:31:39 -08:00

Kconfig.kmemcheck

…

kfifo.c

kfifo: fix kfifo_alloc() and kfifo_init()

2013-02-27 19:10:23 -08:00

klist.c

klist: del waiter from klist_remove_waiters before wakeup waitting process

2013-05-21 10:16:39 -07:00

kobject_uevent.c

netlink: hide struct module parameter in netlink_kernel_create

2012-09-08 18:46:30 -04:00

kobject.c

kref: minor cleanup

2013-05-07 16:09:00 -07:00

kstrtox.c

kstrto*: add documentation

2012-12-17 17:15:22 -08:00

kstrtox.h

lib/kstrtox: common code between kstrto*() and simple_strto*() functions

2011-10-31 17:30:56 -07:00

lcm.c

lib: reduce the use of module.h wherever possible

2012-03-07 15:04:04 -05:00

libcrc32c.c

…

list_debug.c

rcu: Fix broken strings in RCU's source code.

2012-07-06 06:01:49 -07:00

list_sort.c

lib/: rename random32() to prandom_u32()

2013-04-29 18:28:42 -07:00

llist.c

Merge tag 'split-asm_system_h-for-linus-20120328' of git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-asm_system

2012-03-28 15:58:21 -07:00

locking-selftest-hardirq.h

…

locking-selftest-mutex.h

…

locking-selftest-rlock-hardirq.h

…

locking-selftest-rlock-softirq.h

…

locking-selftest-rlock.h

…

locking-selftest-rsem.h

…

locking-selftest-softirq.h

…

locking-selftest-spin-hardirq.h

…

locking-selftest-spin-softirq.h

…

locking-selftest-spin.h

…

locking-selftest-wlock-hardirq.h

…

locking-selftest-wlock-softirq.h

…

locking-selftest-wlock.h

…

locking-selftest-wsem.h

…

locking-selftest.c

lockdep: Selftest: convert spinlock to raw spinlock

2013-02-19 08:43:35 +01:00

lru_cache.c

lru_cache: introduce lc_get_cumulative()

2013-03-22 22:17:36 -06:00

Makefile

x86, hweight: Fix BUG when booting with CONFIG_GCOV_PROFILE_ALL=y

2014-02-20 11:06:11 -08:00

md5.c

lib: reduce the use of module.h wherever possible

2012-03-07 15:04:04 -05:00

memory-notifier-error-inject.c

memory: memory notifier error injection module

2012-07-30 17:25:22 -07:00

memweight.c

string: introduce memweight()

2012-07-30 17:25:16 -07:00

nlattr.c

netlink: rate-limit leftover bytes warning and print process name

2014-06-26 15:12:37 -04:00

notifier-error-inject.c

mode_t, whack-a-mole at 11...

2013-04-09 14:13:05 -04:00

notifier-error-inject.h

fault-injection: notifier error injection

2012-07-30 17:25:22 -07:00

of-reconfig-notifier-error-inject.c

powerpc+of: Rename and fix OF reconfig notifier error inject module

2012-12-14 10:32:52 +11:00

oid_registry.c

Give the OID registry file module info to avoid kernel tainting

2013-05-05 14:38:00 -07:00

parser.c

lib/parser.c: fix up comments for valid return values from match_number

2013-02-21 17:22:25 -08:00

pci_iomap.c

lib: add NO_GENERIC_PCI_IOPORT_MAP

2012-01-31 23:19:47 +02:00

percpu_counter.c

switch the protection of percpu_counter list to spinlock

2012-07-31 09:28:31 +04:00

percpu-rwsem.c

percpu_rw_semaphore: add lockdep annotations

2012-12-17 17:15:18 -08:00

plist.c

lib/plist.c: make plist test announcements KERN_DEBUG

2012-10-06 03:04:58 +09:00

pm-notifier-error-inject.c

PM: PM notifier error injection module

2012-07-30 17:25:22 -07:00

prio_heap.c

…

proportions.c

locking, lib/proportions: Annotate prop_local_percpu::lock as raw

2011-09-13 11:11:50 +02:00

radix-tree.c

radix-tree: fix contiguous iterator

2012-06-05 10:46:40 -07:00

random32.c

random32: fix off-by-one in seeding requirement

2013-12-08 07:29:24 -08:00

ratelimit.c

lib: reduce the use of module.h wherever possible

2012-03-07 15:04:04 -05:00

rational.c

lib: Change mail address of Oskar Schirmer

2012-05-17 15:18:37 +02:00

rbtree_test.c

rbtree_test: add __init/__exit annotations

2013-04-30 17:04:07 -07:00

rbtree.c

lib/rbtree.c: avoid the use of non-static __always_inline

2013-01-11 14:54:56 -08:00

reciprocal_div.c

sch_red: Adaptative RED AQM

2011-12-08 19:52:43 -05:00

rwsem-spinlock.c

rwsem: simplify __rwsem_do_wake

2013-05-07 07:20:16 -07:00

rwsem.c

rwsem: check counter to avoid cmpxchg calls

2013-05-07 16:11:51 -07:00

scatterlist.c

lib/scatterlist.c: don't flush_kernel_dcache_page on slab page

2013-11-13 12:05:33 +09:00

sha1.c

lib: reduce the use of module.h wherever possible

2012-03-07 15:04:04 -05:00

show_mem.c

mm, show_mem: suppress page counts in non-blockable contexts

2013-04-29 15:54:28 -07:00

smp_processor_id.c

lib: reduce the use of module.h wherever possible

2012-03-07 15:04:04 -05:00

sort.c

…

spinlock_debug.c

lib/spinlock_debug: avoid livelock in do_raw_spin_lock()

2012-10-06 03:04:57 +09:00

stmp_device.c

lib: add support for stmp-style devices

2012-04-20 23:27:08 +02:00

string_helpers.c

lib/string_helpers: introduce generic string_unescape

2013-04-30 17:04:03 -07:00

string.c

random: add and use memzero_explicit() for clearing data

2014-11-14 08:47:55 -08:00

strncpy_from_user.c

word-at-a-time: make the interfaces truly generic

2012-05-26 11:33:40 -07:00

strnlen_user.c

lib: Fix generic strnlen_user for 32-bit big-endian machines

2012-05-27 20:59:46 -07:00

swiotlb.c

x86, kdump: Set crashkernel_low automatically

2013-04-17 12:35:32 -07:00

syscall.c

lib: reduce the use of module.h wherever possible

2012-03-07 15:04:04 -05:00

test-kstrtox.c

lib/test-kstrtox.c: mark const init data with __initconst instead of __initdata

2012-05-29 16:22:32 -07:00

test-string_helpers.c

lib/string_helpers: introduce generic string_unescape

2013-04-30 17:04:03 -07:00

textsearch.c

…

timerqueue.c

Merge tag 'module-for-3.4' of git://git.kernel.org/pub/scm/linux/kernel/git/paulg/linux

2012-03-24 10:24:31 -07:00

ts_bm.c

…

ts_fsm.c

…

ts_kmp.c

…

ucs2_string.c

Move utf16 functions to kernel core and rename

2013-04-15 21:23:03 +01:00

usercopy.c

Kconfig: consolidate CONFIG_DEBUG_STRICT_USER_COPY_CHECKS

2013-04-30 17:04:09 -07:00

uuid.c

uuid: use prandom_bytes()

2013-04-29 18:28:42 -07:00

vsprintf.c

vsprintf: check real user/group id for %pK

2013-12-04 10:56:06 -08:00