jffs2: Fix rtime decompressor

richardweinberger · richardweinberger · commit b29bf7119d6b · 2024-12-05T12:31:40.000+01:00
The fix for a memory corruption contained a off-by-one error and caused the compressor to fail in legit cases. Cc: Kinsey Moore <kinsey.moore@oarcorp.com> Cc: stable@vger.kernel.org Fixes: fe05155 ("jffs2: Prevent rtime decompress memory corruption") Signed-off-by: Richard Weinberger <richard@nod.at>
diff --git a/fs/jffs2/compr_rtime.c b/fs/jffs2/compr_rtime.c
@@ -95,7 +95,7 @@ static int jffs2_rtime_decompress(unsigned char *data_in,
 
 		positions[value]=outpos;
 		if (repeat) {
-			if ((outpos + repeat) >= destlen) {
+			if ((outpos + repeat) > destlen) {
 				return 1;
 			}
 			if (backoffs + repeat >= outpos) {

Original file line number	Diff line number	Diff line change
`@@ -95,7 +95,7 @@ static int jffs2_rtime_decompress(unsigned char *data_in,`
`95`	`95`
`96`	`96`	`positions[value]=outpos;`
`97`	`97`	`if (repeat) {`
`98`		`- if ((outpos + repeat) >= destlen) {`
	`98`	`+ if ((outpos + repeat) > destlen) {`
`99`	`99`	`return 1;`
`100`	`100`	`}`
`101`	`101`	`if (backoffs + repeat >= outpos) {`