lkml.org 
[lkml]   [2014]   [Jul]   [4]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 3.14 53/59] lz4: add overrun checks to lz4_uncompress_unknownoutputsize()
    Date
    3.14-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    commit 4a3a99045177369700c60d074c0e525e8093b0fc upstream.

    Jan points out that I forgot to make the needed fixes to the
    lz4_uncompress_unknownoutputsize() function to mirror the changes done
    in lz4_decompress() with regards to potential pointer overflows.

    The only in-kernel user of this function is the zram code, which only
    takes data from a valid compressed buffer that it made itself, so it's
    not a big issue. But due to external kernel modules using this
    function, it's better to be safe here.

    Reported-by: Jan Beulich <JBeulich@suse.com>
    Cc: "Don A. Bailey" <donb@securitymouse.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    lib/lz4/lz4_decompress.c | 6 +++++-
    1 file changed, 5 insertions(+), 1 deletion(-)

    --- a/lib/lz4/lz4_decompress.c
    +++ b/lib/lz4/lz4_decompress.c
    @@ -192,6 +192,8 @@ static int lz4_uncompress_unknownoutputs
    int s = 255;
    while ((ip < iend) && (s == 255)) {
    s = *ip++;
    + if (unlikely(length > (size_t)(length + s)))
    + goto _output_error;
    length += s;
    }
    }
    @@ -232,6 +234,8 @@ static int lz4_uncompress_unknownoutputs
    if (length == ML_MASK) {
    while (ip < iend) {
    int s = *ip++;
    + if (unlikely(length > (size_t)(length + s)))
    + goto _output_error;
    length += s;
    if (s == 255)
    continue;
    @@ -284,7 +288,7 @@ static int lz4_uncompress_unknownoutputs

    /* write overflow error detected */
    _output_error:
    - return (int) (-(((char *) ip) - source));
    + return -1;
    }

    int lz4_decompress(const unsigned char *src, size_t *src_len,



    \
     
     \ /
      Last update: 2014-07-05 01:21    [W:4.113 / U:0.468 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site