ar71xx: add sanity checks to decode_rle

Also use -EINVAL instead of -1.

git-svn-id: svn://svn.openwrt.org/openwrt/trunk@31353 3c298f89-4303-0410-b956-a3cf2f4a3e73

diff --git a/target/linux/ar71xx/files/arch/mips/ath79/mach-rb750.c b/target/linux/ar71xx/files/arch/mips/ath79/mach-rb750.c
index 3e4a552..30d8eac 100644 (file)
--- a/target/linux/ar71xx/files/arch/mips/ath79/mach-rb750.c
+++ b/target/linux/ar71xx/files/arch/mips/ath79/mach-rb750.c
@@ -299,24 +299,29 @@ static int decode_rle(char *output, int len, char *in)
 {
        char *ptr = output;
        char *end = output + len;
+
+       if (!output || !in)
+               return -EINVAL;
+
        while (*in) {
                if (*in < 0) {
                        int i = -*in++;
                        while (i-- > 0) {
                                if (ptr >= end)
-                                       return -1;
+                                       return -EINVAL;
                                *ptr++ = *in++;
                        }
                } else if (*in > 0) {
                        int i = *in++;
                        while (i-- > 0) {
                                if (ptr >= end)
-                                       return -1;
+                                       return -EINVAL;
                                *ptr++ = *in;
                        }
                        in++;
                }
        }
+
        return ptr - output;
 }