ar71xx: add sanity checks to decode_rle

Also use -EINVAL instead of -1.

git-svn-id: svn://svn.openwrt.org/openwrt/trunk@31353 3c298f89-4303-0410-b956-a3cf2f4a3e73

1 files changed, 7 insertions, 2 deletions

diff --git a/target/linux/ar71xx/files/arch/mips/ath79/mach-rb750.c b/target/linux/ar71xx/files/arch/mips/ath79/mach-rb750.c
index 3e4a5527f8..30d8eac796 100644
--- a/target/linux/ar71xx/files/arch/mips/ath79/mach-rb750.c
+++ b/target/linux/ar71xx/files/arch/mips/ath79/mach-rb750.c
@@ -299,24 +299,29 @@ static int decode_rle(char *output, int len, char *in)
 {
 	char *ptr = output;
 	char *end = output + len;
+
+	if (!output || !in)
+		return -EINVAL;
+
 	while (*in) {
 		if (*in < 0) {
 			int i = -*in++;
 			while (i-- > 0) {
 				if (ptr >= end)
-					return -1;
+					return -EINVAL;
 				*ptr++ = *in++;
 			}
 		} else if (*in > 0) {
 			int i = *in++;
 			while (i-- > 0) {
 				if (ptr >= end)
-					return -1;
+					return -EINVAL;
 				*ptr++ = *in;
 			}
 			in++;
 		}
 	}
+
 	return ptr - output;
 }