uclinux: fix gzip header parsing in binfmt_flat.c
authorVolodymyr G. Lukiianyk <volodymyrgl@gmail.com>
Thu, 16 Oct 2008 05:01:15 +0000 (22:01 -0700)
committerLinus Torvalds <torvalds@linux-foundation.org>
Thu, 16 Oct 2008 18:21:29 +0000 (11:21 -0700)
commitf4cfb18d7917ecb397b3497e931a2a23175709b7
treebb891b0f478e2ed7fa9dcefacc0b8342ce1b43d6
parent0c6aa2639ea83bfb7f91d72118bad70b3f60012a
uclinux: fix gzip header parsing in binfmt_flat.c

There are off-by-one errors in decompress_exec() when calculating the length of
optional "original file name" and "comment" fields: the "ret" index is not
incremented when terminating '\0' character is reached. The check of the buffer
overflow (after an "extra-field" length was taken into account) is also fixed.

I've encountered this off-by-one error when tried to reuse
gzip-header-parsing part of the decompress_exec() function.  There was an
"original file name" field in the payload (with miscalculated length) and
zlib_inflate() returned Z_DATA_ERROR.  But after the fix similar to this
one all worked fine.

Signed-off-by: Volodymyr G Lukiianyk <volodymyrgl@gmail.com>
Acked-by: Greg Ungerer <gerg@snapgear.com>
Acked-by: David Howells <dhowells@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
fs/binfmt_flat.c