unsigned char *start = dst;
const unsigned char *send = src + src_len;
u32 slen, dlen;
- size_t tmp;
+ size_t tmp, remaining;
int r;
src = parse_header(src);
if (!src)
return LZO_E_ERROR;
+ remaining = *dst_len;
while (src < send) {
/* read uncompressed block size */
dlen = get_unaligned_be32(src);
if (slen <= 0 || slen > dlen)
return LZO_E_ERROR;
- /* decompress */
- tmp = dlen;
- r = lzo1x_decompress_safe((u8 *) src, slen, dst, &tmp);
-
- if (r != LZO_E_OK)
- return r;
+ /* abort if buffer ran out of room */
+ if (dlen > remaining)
+ return LZO_E_OUTPUT_OVERRUN;
+
+ /* When the input data is not compressed at all,
+ * lzo1x_decompress_safe will fail, so call memcpy()
+ * instead */
+ if (dlen == slen) {
+ memcpy(dst, src, slen);
+ } else {
+ /* decompress */
+ tmp = dlen;
+ r = lzo1x_decompress_safe((u8 *)src, slen, dst, &tmp);
+
+ if (r != LZO_E_OK) {
+ *dst_len = dst - start;
+ return r;
+ }
- if (dlen != tmp)
- return LZO_E_ERROR;
+ if (dlen != tmp)
+ return LZO_E_ERROR;
+ }
src += slen;
dst += dlen;
+ remaining -= dlen;
}
return LZO_E_INPUT_OVERRUN;