From f2c35a9fd41ff2018cbcb505c1d12fd9fbce174e Mon Sep 17 00:00:00 2001 From: Roy Oursler Date: Mon, 13 Mar 2017 15:32:57 -0700 Subject: [PATCH] igzip: Fix underflow bugs whe null pointer is passed in igzip base functions Change-Id: Ia24326dcde6f8be9ee019690b8206d2779ddebb2 Signed-off-by: Roy Oursler --- igzip/igzip_base.c | 4 ++-- igzip/igzip_icf_base.c | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/igzip/igzip_base.c b/igzip/igzip_base.c index e33b2d1..54262c5 100644 --- a/igzip/igzip_base.c +++ b/igzip/igzip_base.c @@ -45,7 +45,7 @@ void isal_deflate_body_base(struct isal_zstream *stream) end_in = start_in + stream->avail_in; next_in = start_in; - while (next_in < end_in - ISAL_LOOK_AHEAD) { + while (next_in + ISAL_LOOK_AHEAD < end_in) { if (is_full(&state->bitbuf)) { update_state(stream, start_in, next_in, end_in); @@ -125,7 +125,7 @@ void isal_deflate_finish_base(struct isal_zstream *stream) end_in = start_in + stream->avail_in; next_in = start_in; - while (next_in < end_in - 3) { + while (next_in + 3 < end_in) { if (is_full(&state->bitbuf)) { update_state(stream, start_in, next_in, end_in); return; diff --git a/igzip/igzip_icf_base.c b/igzip/igzip_icf_base.c index 4765fbe..be090f8 100644 --- a/igzip/igzip_icf_base.c +++ b/igzip/igzip_icf_base.c @@ -53,7 +53,7 @@ void isal_deflate_icf_body_base(struct isal_zstream *stream) sizeof(struct deflate_icf); next_out = start_out; - while (next_in < end_in - ISAL_LOOK_AHEAD) { + while (next_in + ISAL_LOOK_AHEAD < end_in) { if (next_out >= end_out) { state->state = ZSTATE_CREATE_HDR; @@ -140,7 +140,7 @@ void isal_deflate_icf_finish_base(struct isal_zstream *stream) sizeof(struct deflate_icf); next_out = start_out; - while (next_in < end_in - 3) { + while (next_in + 3 < end_in) { if (next_out >= end_out) { state->state = ZSTATE_CREATE_HDR; update_state(stream, start_in, next_in, end_in, start_out, next_out,