ar71xx: add sanity checks to decode_rle

[openwrt/openwrt.git] / target / linux / ar71xx / files / arch / mips / ath79 / mach-rb750.c

diff --git a/target/linux/ar71xx/files/arch/mips/ath79/mach-rb750.c b/target/linux/ar71xx/files/arch/mips/ath79/mach-rb750.c
index 3e4a5527f80eb5be99284c81fb437ebc17690075..30d8eac7965eefc0c7aa0a5aade4879b6b287cd3 100644 (file)
--- a/target/linux/ar71xx/files/arch/mips/ath79/mach-rb750.c
+++ b/target/linux/ar71xx/files/arch/mips/ath79/mach-rb750.c
@@ -299,24 +299,29 @@ static int decode_rle(char *output, int len, char *in)
 {
        char *ptr = output;
        char *end = output + len;
+
+       if (!output || !in)
+               return -EINVAL;
+
        while (*in) {
                if (*in < 0) {
                        int i = -*in++;
                        while (i-- > 0) {
                                if (ptr >= end)
-                                       return -1;
+                                       return -EINVAL;
                                *ptr++ = *in++;
                        }
                } else if (*in > 0) {
                        int i = *in++;
                        while (i-- > 0) {
                                if (ptr >= end)
-                                       return -1;
+                                       return -EINVAL;
                                *ptr++ = *in;
                        }
                        in++;
                }
        }
+
        return ptr - output;
 }