From 5d0a3f4599e33f32239aa1c9ad5d2741efed653f Mon Sep 17 00:00:00 2001 From: David Oberhollenzer Date: Fri, 27 Sep 2019 23:39:48 +0200 Subject: Fix unwanted sign extension in lzma decompressor First extend the uint8_t to size_t, then do the arithmetic, otherwise there is an addtional implicit conversion to int, possibly resulting in unwanted sign extension. Signed-off-by: David Oberhollenzer --- lib/sqfs/comp/lzma.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/lib/sqfs/comp/lzma.c b/lib/sqfs/comp/lzma.c index 0238df0..002376f 100644 --- a/lib/sqfs/comp/lzma.c +++ b/lib/sqfs/comp/lzma.c @@ -98,10 +98,10 @@ static sqfs_s32 lzma_uncomp_block(sqfs_compressor_t *base, const sqfs_u8 *in, if (size < sizeof(lzma_header)) return SQFS_ERROR_CORRUPTED; - hdrsize = in[LZMA_SIZE_OFFSET] | - (in[LZMA_SIZE_OFFSET + 1] << 8) | - (in[LZMA_SIZE_OFFSET + 2] << 16) | - (in[LZMA_SIZE_OFFSET + 3] << 24); + hdrsize = (size_t)in[LZMA_SIZE_OFFSET] | + ((size_t)in[LZMA_SIZE_OFFSET + 1] << 8) | + ((size_t)in[LZMA_SIZE_OFFSET + 2] << 16) | + ((size_t)in[LZMA_SIZE_OFFSET + 3] << 24); if (hdrsize > outsize) return 0; -- cgit v1.2.3