| Date | Tue, 24 Jun 2014 16:59:01 -0400 | From | Greg Kroah-Hartman <> | Subject | Re: [PATCH 3.15 49/61] lz4: ensure length does not wrap |
| |
On Tue, Jun 24, 2014 at 10:28:31AM -0600, Don A. Bailey wrote: > Objection. Patch needs slight adjustment. Emailing separately. >
Dragging this back to lkml, here's a proposed patch for this, I'll write it up for "real" and submit it tomorrow.
thanks,
greg k-h
-------------------------- From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Subject: lz4: add additional checks
diff --git a/lib/lz4/lz4_decompress.c b/lib/lz4/lz4_decompress.c index 99a03acb7d47..b74da447e81e 100644 --- a/lib/lz4/lz4_decompress.c +++ b/lib/lz4/lz4_decompress.c @@ -108,6 +108,8 @@ static int lz4_uncompress(const char *source, char *dest, int osize) if (length == ML_MASK) { for (; *ip == 255; length += 255) ip++; + if (unlikely(length > (size_t)(length + *ip))) + goto _output_error; length += *ip++; } @@ -157,7 +159,7 @@ static int lz4_uncompress(const char *source, char *dest, int osize) /* write overflow error detected */ _output_error: - return (int) (-(((char *)ip) - source)); + return -1; } static int lz4_uncompress_unknownoutputsize(const char *source, char *dest,
|