[BusyBox-cvs] svn commit: trunk/busybox/archival/libunarchive

[mjn3 at busybox.net]

Author: mjn3
Date: 2005-03-01 12:29:29 -0700 (Tue, 01 Mar 2005)
New Revision: 9950

Log:
When filling the bit buffer, gzip decompression apparently never checked for end of file, causing it to hang on corrupted input.

Modified:
   trunk/busybox/archival/libunarchive/decompress_unzip.c


Changeset:
Modified: trunk/busybox/archival/libunarchive/decompress_unzip.c
===================================================================
--- trunk/busybox/archival/libunarchive/decompress_unzip.c	2005-03-01 17:43:36 UTC (rev 9949)
+++ trunk/busybox/archival/libunarchive/decompress_unzip.c	2005-03-01 19:29:29 UTC (rev 9950)
@@ -151,7 +151,10 @@
 			/* Leave the first 4 bytes empty so we can always unwind the bitbuffer
 			 * to the front of the bytebuffer, leave 4 bytes free at end of tail
 			 * so we can easily top up buffer in check_trailer_gzip() */
-			bytebuffer_size = 4 + bb_xread(gunzip_src_fd, &bytebuffer[4], bytebuffer_max - 8);
+			if (!(bytebuffer_size = bb_xread(gunzip_src_fd, &bytebuffer[4], bytebuffer_max - 8))) {
+				bb_error_msg_and_die("unexpected end of file");
+			}
+			bytebuffer_size += 4;
 			bytebuffer_offset = 4;
 		}
 		bitbuffer |= ((unsigned int) bytebuffer[bytebuffer_offset]) << *current;