Decompressors: fix header validation in unlzma.c From: Lasse Collin Validation of header.pos calls error() but doesn't make the function return to indicate an error to the caller. Instead the decoding is attempted with invalid header.pos. This fixes it. Signed-off-by: Lasse Collin Signed-off-by: Jan Beulich --- a/xen/common/unlzma.c +++ b/xen/common/unlzma.c @@ -568,8 +568,10 @@ STATIC int INIT unlzma(unsigned char *bu ((unsigned char *)&header)[i] = *rc.ptr++; } - if (header.pos >= (9 * 5 * 5)) + if (header.pos >= (9 * 5 * 5)) { error("bad header"); + goto exit_1; + } mi = 0; lc = header.pos;