tree 86599c12e2ee8b50fe5b3ab98ea1d12329180e05
parent 288edbb3a16b3b857508e2f70d0fb43091f2858f
author Erik de Castro Lopo <erikd@mega-nerd.com> 1416454559 -0800
committer Erik de Castro Lopo <erikd@mega-nerd.com> 1416881035 +1100

src/libFACL/stream_decoder.c : Fail safely to avoid a heap overflow.

A file provided by the reporters caused the stream decoder to write to
un-allocated heap space resulting in a segfault. The solution is to
error out (by returning false from read_residual_partitioned_rice_())
instead of trying to continue to decode.

Fixes: CVE-2014-9028
Reported-by: Michele Spagnuolo,
             Google Security Team <mikispag@google.com>