lkml.org 
[lkml]   [2014]   [Jun]   [24]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
Date
From
SubjectRe: [PATCH 3.15 49/61] lz4: ensure length does not wrap
On Tue, Jun 24, 2014 at 10:28:31AM -0600, Don A. Bailey wrote:
> Objection. Patch needs slight adjustment. Emailing separately.
>

Dragging this back to lkml, here's a proposed patch for this, I'll write
it up for "real" and submit it tomorrow.

thanks,

greg k-h

--------------------------
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Subject: lz4: add additional checks



diff --git a/lib/lz4/lz4_decompress.c b/lib/lz4/lz4_decompress.c
index 99a03acb7d47..b74da447e81e 100644
--- a/lib/lz4/lz4_decompress.c
+++ b/lib/lz4/lz4_decompress.c
@@ -108,6 +108,8 @@ static int lz4_uncompress(const char *source, char *dest, int osize)
if (length == ML_MASK) {
for (; *ip == 255; length += 255)
ip++;
+ if (unlikely(length > (size_t)(length + *ip)))
+ goto _output_error;
length += *ip++;
}

@@ -157,7 +159,7 @@ static int lz4_uncompress(const char *source, char *dest, int osize)

/* write overflow error detected */
_output_error:
- return (int) (-(((char *)ip) - source));
+ return -1;
}

static int lz4_uncompress_unknownoutputsize(const char *source, char *dest,

\
 
 \ /
  Last update: 2014-06-24 23:41    [W:0.222 / U:0.184 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site