decompress_bunzip2: off by one in get_next_block()

[mirror_ubuntu-artful-kernel.git] / lib / decompress_bunzip2.c

diff --git a/lib/decompress_bunzip2.c b/lib/decompress_bunzip2.c
index 8290e0bef7eabd9f4284b9e2558f8a4e9afab6b0..6dd0335ea61b296b5dfd77818e58e294fb2e805c 100644 (file)
--- a/lib/decompress_bunzip2.c
+++ b/lib/decompress_bunzip2.c
@@ -184,7 +184,7 @@ static int INIT get_next_block(struct bunzip_data *bd)
        if (get_bits(bd, 1))
                return RETVAL_OBSOLETE_INPUT;
        origPtr = get_bits(bd, 24);
-       if (origPtr > dbufSize)
+       if (origPtr >= dbufSize)
                return RETVAL_DATA_ERROR;
        /* mapping table: if some byte values are never used (encoding things
           like ascii text), the compression code removes the gaps to have fewer