wok-current rev 666
linux & busybox: memory leak in unlzma
author | Pascal Bellard <pascal.bellard@slitaz.org> |
---|---|
date | Wed Apr 23 08:46:02 2008 +0000 (2008-04-23) |
parents | fb8167e6c7f5 |
children | edd31fe73ba8 |
files | busybox/receipt busybox/stuff/busybox-1.10.1-unlzma.u linux/stuff/linux-lzma-2.6.24.2.u |
line diff
1.1 --- a/busybox/receipt Wed Apr 23 01:14:59 2008 +0200 1.2 +++ b/busybox/receipt Wed Apr 23 08:46:02 2008 +0000 1.3 @@ -21,6 +21,7 @@ 1.4 patch -p1 < ../stuff/$PACKAGE-$VERSION-dhcpc.u 1.5 patch -p1 < ../stuff/$PACKAGE-$VERSION-cpio-mkdir.u 1.6 patch -p1 < ../stuff/$PACKAGE-$VERSION-cpio-mtime.u 1.7 + patch -p1 < ../stuff/$PACKAGE-$VERSION-unlzma.u 1.8 cp ../stuff/$PACKAGE-$VERSION.config .config 1.9 make oldconfig 1.10 make && make install
2.1 --- /dev/null Thu Jan 01 00:00:00 1970 +0000 2.2 +++ b/busybox/stuff/busybox-1.10.1-unlzma.u Wed Apr 23 08:46:02 2008 +0000 2.3 @@ -0,0 +1,23 @@ 2.4 +--- busybox-1.10.1/archival/libunarchive/decompress_unlzma.c 2.5 ++++ busybox-1.10.1/archival/libunarchive/decompress_unlzma.c 2.6 +@@ -491,10 +491,16 @@ 2.7 + 2.8 + if (full_write(dst_fd, buffer, buffer_pos) != buffer_pos) { 2.9 + bad: 2.10 ++ len = -1; 2.11 ++ } 2.12 ++ else { 2.13 ++ USE_DESKTOP(total_written += buffer_pos;) 2.14 ++ len = USE_DESKTOP(total_written) + 0; 2.15 ++ } 2.16 ++ if (ENABLE_FEATURE_CLEAN_UP) { 2.17 + rc_free(rc); 2.18 +- return -1; 2.19 ++ free(buffer); 2.20 ++ free(p); 2.21 + } 2.22 +- rc_free(rc); 2.23 +- USE_DESKTOP(total_written += buffer_pos;) 2.24 +- return USE_DESKTOP(total_written) + 0; 2.25 ++ return len; 2.26 + }
3.1 --- a/linux/stuff/linux-lzma-2.6.24.2.u Wed Apr 23 01:14:59 2008 +0200 3.2 +++ b/linux/stuff/linux-lzma-2.6.24.2.u Wed Apr 23 08:46:02 2008 +0000 3.3 @@ -1624,7 +1624,7 @@ 3.4 3.5 --- linux-2.6.24.2/lib/decompress_unlzma.c 3.6 +++ linux-2.6.24.2/lib/decompress_unlzma.c 3.7 -@@ -0,0 +1,605 @@ 3.8 +@@ -0,0 +1,601 @@ 3.9 +/* Lzma decompressor for Linux kernel. Shamelessly snarfed 3.10 + * from busybox 1.1.1 3.11 + * 3.12 @@ -2050,20 +2050,20 @@ 3.13 + prob_lit = prob + mi; 3.14 + rc_get_bit(&rc, prob_lit, &mi); 3.15 + } 3.16 ++ if (state < 4) 3.17 ++ state = 0; 3.18 ++ else if (state < 10) 3.19 ++ state -= 3; 3.20 ++ else 3.21 ++ state -= 6; 3.22 + previous_byte = (uint8_t) mi; 3.23 -+ 3.24 ++ one_byte: 3.25 + buffer[buffer_pos++] = previous_byte; 3.26 + if (buffer_pos == header.dict_size) { 3.27 + buffer_pos = 0; 3.28 + global_pos += header.dict_size; 3.29 + writebb((char*)buffer, header.dict_size); 3.30 + } 3.31 -+ if (state < 4) 3.32 -+ state = 0; 3.33 -+ else if (state < 10) 3.34 -+ state -= 3; 3.35 -+ else 3.36 -+ state -= 6; 3.37 + } else { 3.38 + int offset; 3.39 + uint16_t *prob_len; 3.40 @@ -2095,13 +2095,7 @@ 3.41 + goto fail; 3.42 + } 3.43 + previous_byte = buffer[pos]; 3.44 -+ buffer[buffer_pos++] = previous_byte; 3.45 -+ if (buffer_pos == header.dict_size) { 3.46 -+ buffer_pos = 0; 3.47 -+ global_pos += header.dict_size; 3.48 -+ writebb((char*)buffer, header.dict_size); 3.49 -+ } 3.50 -+ continue; 3.51 ++ goto one_byte; 3.52 + } else { 3.53 + rc_update_bit_1(&rc, prob); 3.54 + } 3.55 @@ -2225,9 +2219,11 @@ 3.56 + *posp = rc.ptr-rc.buffer; 3.57 + } 3.58 + large_free(buffer); 3.59 ++ large_free(p); 3.60 + return 0; 3.61 + fail: 3.62 + large_free(buffer); 3.63 ++ large_free(p); 3.64 + return -1; 3.65 +} 3.66