CVSROOT: /cvs
Module name: src
Changes by: [email protected] 2026/10/10 21:02:17
Modified files:
sys/net : bsd-comp.c
Log message:
Fix an off-by-one in bsd_decompress()
An incorrect bounds check for the LZW KwKwK case allows the creation of a
self-refential dictionary entry, resulting in an infinite expansion loop
that writes backward from the output mbuf, corrupting kernel memory.
This is an ancient buffer overflow that is also present in the version of
the code in RFC 1977.
>From Acts1631
ok deraadt
