DragonFlyBSD Kernel Audit
DF-0934 / fix.diff
← back to finding ↓ download raw
diff --git a/sys/vfs/ntfs/ntfs_compr.c b/sys/vfs/ntfs/ntfs_compr.c
--- a/sys/vfs/ntfs/ntfs_compr.c
+++ b/sys/vfs/ntfs/ntfs_compr.c
@@ -102,12 +102,14 @@
 	int             off = 0;
 	int             new;
 
-	for (i = 0; i * NTFS_COMPBLOCK_SIZE < ntfs_cntob(NTFS_COMPUNIT_CL); i++) {
-		new = ntfs_uncompblock(uup + i * NTFS_COMPBLOCK_SIZE, cup + off);
-		if (new == 0)
-			return (EINVAL);
-		off += new;
-	}
+	for (i = 0; i * NTFS_COMPBLOCK_SIZE < ntfs_cntob(NTFS_COMPUNIT_CL); i++) {
+		if (off < 0 || off + 2 > ntfs_cntob(NTFS_COMPUNIT_CL))
+			return (EINVAL);
+		new = ntfs_uncompblock(uup + i * NTFS_COMPBLOCK_SIZE, cup + off);
+		if (new == 0)
+			return (EINVAL);
+		off += new;
+	}
 	return (0);
 }