aboutsummaryrefslogtreecommitdiffstats
path: root/main/squashfs-tools/CVE-2015-4645.patch
blob: 34d208baaef881c163e2b3033a2e7bb3f2c0fc68 (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
--- ./squashfs-tools/unsquash-4.c.orig
+++ ./squashfs-tools/unsquash-4.c
@@ -31,8 +31,9 @@
 
 int read_fragment_table_4()
 {
-	int res, i, indexes = SQUASHFS_FRAGMENT_INDEXES(sBlk.s.fragments);
-	long long fragment_table_index[indexes];
+	int res, i;
+	size_t indexes = SQUASHFS_FRAGMENT_INDEXES(sBlk.s.fragments);
+	long long *fragment_table_index;
 
 	TRACE("read_fragment_table: %d fragments, reading %d fragment indexes "
 		"from 0x%llx\n", sBlk.s.fragments, indexes,
@@ -40,6 +41,11 @@
 
 	if(sBlk.s.fragments == 0)
 		return TRUE;
+
+	fragment_table_index = malloc(indexes*sizeof(long long));
+	if(fragment_table_index == NULL)
+		EXIT_UNSQUASH("read_fragment_table: failed to allocate "
+			"fragment table index\n");
 
 	fragment_table = malloc(sBlk.s.fragments *
 		sizeof(struct squashfs_fragment_entry));