fix potential decompressor crash with Negative size passed to memcpy

#16
inikep · Jun 23, 2018 · 02491c7 · 02491c7
1 parent 6a1ed71
commit 02491c7
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 2 deletions.
diff --git a/lib/lizard_decompress_liz.h b/lib/lizard_decompress_liz.h
@@ -203,7 +203,7 @@ FORCE_INLINE int Lizard_decompress_LIZv1(
     /* last literals */
     length = ctx->literalsEnd - ctx->literalsPtr;
     cpy = op + length;
-    if ((ctx->literalsPtr+length != iend) || (cpy > oend)) { LIZARD_LOG_DECOMPRESS_LIZv1("14"); goto _output_error; }   /* Error : input must be consumed */
+    if ((length < 0) || (ctx->literalsPtr+length != iend) || (cpy > oend)) { LIZARD_LOG_DECOMPRESS_LIZv1("14"); goto _output_error; }   /* Error : input must be consumed */
     memcpy(op, ctx->literalsPtr, length);
     ctx->literalsPtr += length;
     op += length;

diff --git a/lib/lizard_decompress_lz4.h b/lib/lizard_decompress_lz4.h
@@ -147,7 +147,7 @@ FORCE_INLINE int Lizard_decompress_LZ4(
     /* last literals */
     length = ctx->literalsEnd - ctx->literalsPtr;
     cpy = op + length;
-    if ((ctx->literalsPtr+length != iend) || (cpy > oend)) { LIZARD_LOG_DECOMPRESS_LZ4("9"); goto _output_error; }   /* Error : input must be consumed */
+    if ((length < 0) || (ctx->literalsPtr+length != iend) || (cpy > oend)) { LIZARD_LOG_DECOMPRESS_LZ4("9"); goto _output_error; }   /* Error : input must be consumed */
     memcpy(op, ctx->literalsPtr, length);
     ctx->literalsPtr += length;
     op += length;