1*4882a593SmuzhiyunFrom 8301a21773ef61656225e264f4f06ae14462bca7 Mon Sep 17 00:00:00 2001 2*4882a593SmuzhiyunFrom: Jasper Lievisse Adriaanse <j@jasper.la> 3*4882a593SmuzhiyunDate: Fri, 26 Feb 2021 15:21:20 +0100 4*4882a593SmuzhiyunSubject: [PATCH] Fix potential memory corruption with negative memmove() size 5*4882a593Smuzhiyun 6*4882a593SmuzhiyunSigned-off-by: Peter Korsgaard <peter@korsgaard.com> 7*4882a593Smuzhiyun--- 8*4882a593Smuzhiyun lib/lz4.c | 2 +- 9*4882a593Smuzhiyun 1 file changed, 1 insertion(+), 1 deletion(-) 10*4882a593Smuzhiyun 11*4882a593Smuzhiyundiff --git a/lib/lz4.c b/lib/lz4.c 12*4882a593Smuzhiyunindex 5f524d0..c2f504e 100644 13*4882a593Smuzhiyun--- a/lib/lz4.c 14*4882a593Smuzhiyun+++ b/lib/lz4.c 15*4882a593Smuzhiyun@@ -1749,7 +1749,7 @@ LZ4_decompress_generic( 16*4882a593Smuzhiyun const size_t dictSize /* note : = 0 if noDict */ 17*4882a593Smuzhiyun ) 18*4882a593Smuzhiyun { 19*4882a593Smuzhiyun- if (src == NULL) { return -1; } 20*4882a593Smuzhiyun+ if ((src == NULL) || (outputSize < 0)) { return -1; } 21*4882a593Smuzhiyun 22*4882a593Smuzhiyun { const BYTE* ip = (const BYTE*) src; 23*4882a593Smuzhiyun const BYTE* const iend = ip + srcSize; 24*4882a593Smuzhiyun-- 25*4882a593Smuzhiyun2.20.1 26*4882a593Smuzhiyun 27