From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754018AbdDCQOY (ORCPT ); Mon, 3 Apr 2017 12:14:24 -0400 Received: from bh-25.webhostbox.net ([208.91.199.152]:38265 "EHLO bh-25.webhostbox.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753969AbdDCQOW (ORCPT ); Mon, 3 Apr 2017 12:14:22 -0400 From: Guenter Roeck To: Andrew Morton Cc: linux-kernel@vger.kernel.org, Guenter Roeck Subject: [PATCH] zlib inflate: Fix potential buffer overflow Date: Mon, 3 Apr 2017 09:14:19 -0700 Message-Id: <1491236059-32592-1-git-send-email-linux@roeck-us.net> X-Mailer: git-send-email 2.7.4 X-Authenticated_sender: guenter@roeck-us.net X-OutGoing-Spam-Status: No, score=-1.0 X-AntiAbuse: This header was added to track abuse, please include it with any abuse report X-AntiAbuse: Primary Hostname - bh-25.webhostbox.net X-AntiAbuse: Original Domain - vger.kernel.org X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12] X-AntiAbuse: Sender Address Domain - roeck-us.net X-Get-Message-Sender-Via: bh-25.webhostbox.net: authenticated_id: guenter@roeck-us.net X-Authenticated-Sender: bh-25.webhostbox.net: guenter@roeck-us.net X-Source: X-Source-Args: X-Source-Dir: Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org smatch says: lib/zlib_inflate/inftrees.c:240 zlib_inflate_table() error: buffer overflow 'count' 16 <= 16 The loop calculating the value for 'min', which is later used to access count[], can indeed result in an index larger than ARRAY_SIZE(count) if the array is filled with 0. Fixes: 4f3865fb57a04 ("zlib_inflate: Upgrade library code to a recent version") Signed-off-by: Guenter Roeck --- lib/zlib_inflate/inftrees.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/zlib_inflate/inftrees.c b/lib/zlib_inflate/inftrees.c index 3fe6ce5b53e5..028943052926 100644 --- a/lib/zlib_inflate/inftrees.c +++ b/lib/zlib_inflate/inftrees.c @@ -109,7 +109,7 @@ int zlib_inflate_table(codetype type, unsigned short *lens, unsigned codes, *bits = 1; return 0; /* no symbols, but wait for decoding to report error */ } - for (min = 1; min <= MAXBITS; min++) + for (min = 1; min < MAXBITS; min++) if (count[min] != 0) break; if (root < min) root = min; -- 2.7.4