From f0709e3ca8f8947f2d91ed34e92e38a4c23eae63 Mon Sep 17 00:00:00 2001 From: Daniel Veillard Date: Tue, 3 Nov 2015 15:31:25 +0800 Subject: CVE-2015-8035 Fix XZ compression support loop For https://bugzilla.gnome.org/show_bug.cgi?id=757466 DoS when parsing specially crafted XML document if XZ support is compiled in (which wasn't the case for 2.9.2 and master since Nov 2013, fixed in next commit !) Upstream-Status: Backport Signed-off-by: Sona Sarmadi --- xzlib.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/xzlib.c b/xzlib.c index 0dcb9f4..1fab546 100644 --- a/xzlib.c +++ b/xzlib.c @@ -581,6 +581,10 @@ xz_decomp(xz_statep state) xz_error(state, LZMA_DATA_ERROR, "compressed data error"); return -1; } + if (ret == LZMA_PROG_ERROR) { + xz_error(state, LZMA_PROG_ERROR, "compression error"); + return -1; + } } while (strm->avail_out && ret != LZMA_STREAM_END); /* update available output and crc check value */ -- cgit v0.11.2