From 3468a4435a25268068b018e47c8da84d51440b5b Mon Sep 17 00:00:00 2001 From: Christian Franke Date: Thu, 17 Oct 2019 15:12:05 +0200 Subject: [PATCH] lantiq: Fix fw_cutter LzmaWrapper The destination buffer size `d_len` is passed to `lzma_inflate` as a pointer. Therefore, it needs to be dereferenced to compare its content. Signed-off-by: Christian Franke (cherry picked from commit d544bc84a07f299ac1e513715301cae5fbd30923) Signed-off-by: Daniel Golle --- package/kernel/lantiq/ltq-vdsl-fw/src/LzmaWrapper.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/package/kernel/lantiq/ltq-vdsl-fw/src/LzmaWrapper.c b/package/kernel/lantiq/ltq-vdsl-fw/src/LzmaWrapper.c index 7dce05666c..89662b9a5f 100644 --- a/package/kernel/lantiq/ltq-vdsl-fw/src/LzmaWrapper.c +++ b/package/kernel/lantiq/ltq-vdsl-fw/src/LzmaWrapper.c @@ -153,7 +153,7 @@ int lzma_inflate(unsigned char *source, int s_len, unsigned char *dest, int *d_l outStream = 0; else { - if (outSizeFull > d_len) + if (outSizeFull > *d_len) outStream = 0; else outStream = dest;