From d3f59bedb393521986e645bc48c47938f321b643 Mon Sep 17 00:00:00 2001 From: Miloslav Trmač Date: Tue, 1 Oct 2019 22:15:58 +0200 Subject: Update c/image to v4.0.1 and buildah to 1.11.3 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This requires updating all import paths throughout, and a matching buildah update to interoperate. I can't figure out the reason for go.mod tracking github.com/containers/image v3.0.2+incompatible // indirect ((go mod graph) lists it as a direct dependency of libpod, but (go list -json -m all) lists it as an indirect dependency), but at least looking at the vendor subdirectory, it doesn't seem to be actually used in the built binaries. Signed-off-by: Miloslav Trmač --- vendor/github.com/klauspost/compress/fse/decompress.go | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) (limited to 'vendor/github.com/klauspost/compress/fse') diff --git a/vendor/github.com/klauspost/compress/fse/decompress.go b/vendor/github.com/klauspost/compress/fse/decompress.go index 202f36a99..413ec3b3c 100644 --- a/vendor/github.com/klauspost/compress/fse/decompress.go +++ b/vendor/github.com/klauspost/compress/fse/decompress.go @@ -243,7 +243,7 @@ func (s *Scratch) buildDtable() error { nBits := s.actualTableLog - byte(highBits(uint32(nextState))) s.decTable[u].nbBits = nBits newState := (nextState << nBits) - tableSize - if newState > tableSize { + if newState >= tableSize { return fmt.Errorf("newState (%d) outside table size (%d)", newState, tableSize) } if newState == uint16(u) && nBits == 0 { @@ -281,8 +281,12 @@ func (s *Scratch) decompress() error { tmp[off+2] = s1.nextFast() tmp[off+3] = s2.nextFast() off += 4 + // When off is 0, we have overflowed and should write. if off == 0 { s.Out = append(s.Out, tmp...) + if len(s.Out) >= s.DecompressLimit { + return fmt.Errorf("output size (%d) > DecompressLimit (%d)", len(s.Out), s.DecompressLimit) + } } } } else { @@ -296,7 +300,7 @@ func (s *Scratch) decompress() error { off += 4 if off == 0 { s.Out = append(s.Out, tmp...) - off = 0 + // When off is 0, we have overflowed and should write. if len(s.Out) >= s.DecompressLimit { return fmt.Errorf("output size (%d) > DecompressLimit (%d)", len(s.Out), s.DecompressLimit) } -- cgit v1.2.3-54-g00ecf