diff options
| author | Boris Kolpackov <boris@codesynthesis.com> | 2021-05-28 10:37:00 +0200 |
|---|---|---|
| committer | Boris Kolpackov <boris@codesynthesis.com> | 2021-05-28 10:37:00 +0200 |
| commit | 6730152baa777fa04d7c494fa4fb53552f65c703 (patch) | |
| tree | f96666556d0b29c149a9c19e214364aaf5ff641a | |
| parent | 7f88f5ec14ab650600bdc3063c81275f7cd70359 (diff) | |
Apply fix for LZ4 CVE-2021-3520 (upstream commit 8301a2177)
| -rw-r--r-- | libbutl/lz4.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/libbutl/lz4.c b/libbutl/lz4.c index 9f5e9bf..eac0541 100644 --- a/libbutl/lz4.c +++ b/libbutl/lz4.c @@ -1749,7 +1749,7 @@ LZ4_decompress_generic( const size_t dictSize /* note : = 0 if noDict */ ) { - if (src == NULL) { return -1; } + if ((src == NULL) || (outputSize < 0)) { return -1; } { const BYTE* ip = (const BYTE*) src; const BYTE* const iend = ip + srcSize; |