From: Christian Franke <nobody@nowhere.ws>
Date: Thu, 17 Oct 2019 13:12:05 +0000 (+0200)
Subject: lantiq: Fix fw_cutter LzmaWrapper
X-Git-Tag: v19.07.0-rc1~46
X-Git-Url: http://git.openwrt.org/?a=commitdiff_plain;h=3468a4435a25268068b018e47c8da84d51440b5b;p=openwrt%2Fopenwrt.git

lantiq: Fix fw_cutter LzmaWrapper

The destination buffer size `d_len` is passed to `lzma_inflate` as a
pointer. Therefore, it needs to be dereferenced to compare its content.

Signed-off-by: Christian Franke <nobody@nowhere.ws>
(cherry picked from commit d544bc84a07f299ac1e513715301cae5fbd30923)
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
---

diff --git a/package/kernel/lantiq/ltq-vdsl-fw/src/LzmaWrapper.c b/package/kernel/lantiq/ltq-vdsl-fw/src/LzmaWrapper.c
index 7dce05666c..89662b9a5f 100644
--- a/package/kernel/lantiq/ltq-vdsl-fw/src/LzmaWrapper.c
+++ b/package/kernel/lantiq/ltq-vdsl-fw/src/LzmaWrapper.c
@@ -153,7 +153,7 @@ int lzma_inflate(unsigned char *source, int s_len, unsigned char *dest, int *d_l
     outStream = 0;
   else
   {
-    if (outSizeFull > d_len)
+    if (outSizeFull > *d_len)
       outStream = 0;
     else
       outStream = dest;