Corrected : a bug in compression function which could make it read beyond input buffe...

Many thanks for the detailed bug report.

git-svn-id: https://lz4.googlecode.com/svn/trunk@20 650e7d94-2a16-8b24-b05c-7c0b3f6821cd

diff --git a/lz4.c b/lz4.c
index 1fa9aa1..9a96617 100644 (file)
--- a/lz4.c
+++ b/lz4.c
@@ -193,14 +193,14 @@ _endCount:
        }\r
 \r
        // Encode Last Literals\r
-       len = length = iend - anchor;\r
-       if (length)\r
+       len = iend - anchor;\r
+       if (len)\r
        {\r
                orun=op++;\r
                if (len>=(int)RUN_MASK) { *orun=(RUN_MASK<<ML_BITS); len-=RUN_MASK; for(; len > 254 ; len-=255) *op++ = 255; *op++ = (BYTE) len; } \r
                else *orun = (len<<ML_BITS);\r
-               for(;length>0;length-=4) { *(U32*)op = *(U32*)anchor; op+=4; anchor+=4; }\r
-               op += length;    // correction\r
+               while (anchor < iend - 3) { *(U32*)op = *(U32*)anchor; op+=4; anchor+=4; }\r
+               while (anchor < iend ) *op++ = *anchor++;\r
        }\r
 \r
        // End\r