diff options
| author | Gabor Juhos <juhosg@openwrt.org> | 2012-04-19 21:31:40 +0000 |
|---|---|---|
| committer | Gabor Juhos <juhosg@openwrt.org> | 2012-04-19 21:31:40 +0000 |
| commit | 5c9ca38e47cb254b6efe302a955939885340eb16 (patch) | |
| tree | cf144f83865aa94dff173749d0d937680d000266 | |
| parent | 8f921175ba79c56d913f21b76be442dad8feb697 (diff) | |
| download | upstream-5c9ca38e47cb254b6efe302a955939885340eb16.tar.gz upstream-5c9ca38e47cb254b6efe302a955939885340eb16.tar.bz2 upstream-5c9ca38e47cb254b6efe302a955939885340eb16.zip | |
ar71xx: add sanity checks to decode_rle
Also use -EINVAL instead of -1.
SVN-Revision: 31353
| -rw-r--r-- | target/linux/ar71xx/files/arch/mips/ath79/mach-rb750.c | 9 |
1 files changed, 7 insertions, 2 deletions
diff --git a/target/linux/ar71xx/files/arch/mips/ath79/mach-rb750.c b/target/linux/ar71xx/files/arch/mips/ath79/mach-rb750.c index 3e4a5527f8..30d8eac796 100644 --- a/target/linux/ar71xx/files/arch/mips/ath79/mach-rb750.c +++ b/target/linux/ar71xx/files/arch/mips/ath79/mach-rb750.c @@ -299,24 +299,29 @@ static int decode_rle(char *output, int len, char *in) { char *ptr = output; char *end = output + len; + + if (!output || !in) + return -EINVAL; + while (*in) { if (*in < 0) { int i = -*in++; while (i-- > 0) { if (ptr >= end) - return -1; + return -EINVAL; *ptr++ = *in++; } } else if (*in > 0) { int i = *in++; while (i-- > 0) { if (ptr >= end) - return -1; + return -EINVAL; *ptr++ = *in; } in++; } } + return ptr - output; } |