lzx_decompress.c: add missing validation in RLE length decoding

[wimlib] / src / lzx_decompress.c

diff --git a/src/lzx_decompress.c b/src/lzx_decompress.c
index dba27665eb278b1361a60f56998fb41ead8a1d45..fe5bdbad02240a1f1ec21e3516fd9424f34bec5d 100644 (file)
--- a/src/lzx_decompress.c
+++ b/src/lzx_decompress.c
@@ -228,6 +228,8 @@ lzx_read_codeword_lens(struct input_bitstream *istream, u8 *lens, unsigned num_l
                                run_len = 4 + bitstream_read_bits(istream, 1);
                                presym = read_huffsym_using_precode(istream,
                                                                    precode_decode_table);
+                               if (unlikely(presym > 17))
+                                       return -1;
                                len = *len_ptr - presym;
                                if ((s8)len < 0)
                                        len += 17;