From 0f0a58f94f65d3c84e1ab46d91e21f776507e080 Mon Sep 17 00:00:00 2001 From: Daniel Friesel Date: Wed, 20 Jan 2021 23:00:21 +0100 Subject: udeflate: fix off-by-one in uncompressed size check --- src/lib/udeflate.cc | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'src/lib/udeflate.cc') diff --git a/src/lib/udeflate.cc b/src/lib/udeflate.cc index df7c179..c3a051d 100644 --- a/src/lib/udeflate.cc +++ b/src/lib/udeflate.cc @@ -290,10 +290,10 @@ static int8_t udeflate_uncompressed() return UDEFLATE_ERR_NLEN; } udeflate_input_now += 4; - if (udeflate_input_now + len > udeflate_input_end) { + if (udeflate_input_now + len >= udeflate_input_end) { return UDEFLATE_ERR_INPUT_LENGTH; } - if (udeflate_output_now + len > udeflate_output_end) { + if (udeflate_output_now + len >= udeflate_output_end) { return UDEFLATE_ERR_OUTPUT_LENGTH; } for (uint16_t i = 0; i < len; i++) { -- cgit v1.2.3