aboutsummaryrefslogtreecommitdiff
path: root/src/liblzma/common/auto_decoder.c
diff options
context:
space:
mode:
authorLasse Collin <lasse.collin@tukaani.org>2009-04-28 23:08:32 +0300
committerLasse Collin <lasse.collin@tukaani.org>2009-04-28 23:08:32 +0300
commit21c6b94373d239d7e86bd480fcd558e30391712f (patch)
tree072a944fecdd87fcd25a80a723d8b1d220d2f642 /src/liblzma/common/auto_decoder.c
parentFix uint32_t -> size_t in ARM and ARM-Thumb filters. (diff)
downloadxz-21c6b94373d239d7e86bd480fcd558e30391712f.tar.xz
Fixed a crash in liblzma.
liblzma tries to avoid useless free()/malloc() pairs in initialization when multiple files are handled using the same lzma_stream. This didn't work with filter chains due to comparison of wrong pointers in lzma_next_coder_init(), making liblzma think that no memory reallocation is needed even when it actually is. Easy way to trigger this bug is to decompress two files with a single xz command. The first file should have e.g. x86+LZMA2 as the filter chain, and the second file just LZMA2.
Diffstat (limited to '')
-rw-r--r--src/liblzma/common/auto_decoder.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/src/liblzma/common/auto_decoder.c b/src/liblzma/common/auto_decoder.c
index 4420495a..ae6c3e78 100644
--- a/src/liblzma/common/auto_decoder.c
+++ b/src/liblzma/common/auto_decoder.c
@@ -146,7 +146,7 @@ static lzma_ret
auto_decoder_init(lzma_next_coder *next, lzma_allocator *allocator,
uint64_t memlimit, uint32_t flags)
{
- lzma_next_coder_init(auto_decoder_init, next, allocator);
+ lzma_next_coder_init(&auto_decoder_init, next, allocator);
if (memlimit == 0)
return LZMA_PROG_ERROR;