On Wed, Sep 09, 2026 at 12:20:14PM -0700, Sriram Sriram wrote: > From: Drew Kluemke <[email protected]> > > Add an overflow check before the 'len * 20' multiplication used to > compute the maximum decompression buffer size. On platforms where len > exceeds ULONG_MAX / 20 the multiplication wraps to a small value, > leading malloc to allocate a tiny buffer while decompression writes the > full stream -- a heap buffer overflow.
OK, so lets assume an overflow, or just an invalid max_decomp_len, shouldn't image_decomp handle this case and fail and we catch it? -- Tom
signature.asc
Description: PGP signature
