From 8960844a7890b1ac6ad5f8abf58a2a20923dde6d Mon Sep 17 00:00:00 2001 From: Nicolas Pitre Date: Fri, 7 Apr 2006 15:26:10 -0400 Subject: check patch_delta bounds more carefully Let's avoid going south with invalid delta data. Signed-off-by: Nicolas Pitre Signed-off-by: Junio C Hamano --- delta.h | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) (limited to 'delta.h') diff --git a/delta.h b/delta.h index a15350dabc..9464f3e9b0 100644 --- a/delta.h +++ b/delta.h @@ -16,7 +16,8 @@ extern void *patch_delta(void *src_buf, unsigned long src_size, * This must be called twice on the delta data buffer, first to get the * expected reference buffer size, and again to get the result buffer size. */ -static inline unsigned long get_delta_hdr_size(const unsigned char **datap) +static inline unsigned long get_delta_hdr_size(const unsigned char **datap, + const unsigned char *top) { const unsigned char *data = *datap; unsigned char cmd; @@ -26,7 +27,7 @@ static inline unsigned long get_delta_hdr_size(const unsigned char **datap) cmd = *data++; size |= (cmd & ~0x80) << i; i += 7; - } while (cmd & 0x80); + } while (cmd & 0x80 && data < top); *datap = data; return size; } -- cgit v1.2.3