From 9ec35a5650499d3f3b588d42b4d90a3c97d91feb Mon Sep 17 00:00:00 2001 From: juhosg Date: Thu, 19 Apr 2012 21:31:40 +0000 Subject: ar71xx: add sanity checks to decode_rle Also use -EINVAL instead of -1. git-svn-id: svn://svn.openwrt.org/openwrt/trunk@31353 3c298f89-4303-0410-b956-a3cf2f4a3e73 --- target/linux/ar71xx/files/arch/mips/ath79/mach-rb750.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) (limited to 'target/linux/ar71xx/files/arch/mips/ath79') diff --git a/target/linux/ar71xx/files/arch/mips/ath79/mach-rb750.c b/target/linux/ar71xx/files/arch/mips/ath79/mach-rb750.c index 3e4a5527f..30d8eac79 100644 --- a/target/linux/ar71xx/files/arch/mips/ath79/mach-rb750.c +++ b/target/linux/ar71xx/files/arch/mips/ath79/mach-rb750.c @@ -299,24 +299,29 @@ static int decode_rle(char *output, int len, char *in) { char *ptr = output; char *end = output + len; + + if (!output || !in) + return -EINVAL; + while (*in) { if (*in < 0) { int i = -*in++; while (i-- > 0) { if (ptr >= end) - return -1; + return -EINVAL; *ptr++ = *in++; } } else if (*in > 0) { int i = *in++; while (i-- > 0) { if (ptr >= end) - return -1; + return -EINVAL; *ptr++ = *in; } in++; } } + return ptr - output; } -- cgit v1.2.3