lkml.org 
[lkml]   [2021]   [Nov]   [15]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.4 155/355] lib/xz: Validate the value before assigning it to an enum variable
    Date
    From: Lasse Collin <lasse.collin@tukaani.org>

    [ Upstream commit 4f8d7abaa413c34da9d751289849dbfb7c977d05 ]

    This might matter, for example, if the underlying type of enum xz_check
    was a signed char. In such a case the validation wouldn't have caught an
    unsupported header. I don't know if this problem can occur in the kernel
    on any arch but it's still good to fix it because some people might copy
    the XZ code to their own projects from Linux instead of the upstream
    XZ Embedded repository.

    This change may increase the code size by a few bytes. An alternative
    would have been to use an unsigned int instead of enum xz_check but
    using an enumeration looks cleaner.

    Link: https://lore.kernel.org/r/20211010213145.17462-3-xiang@kernel.org
    Signed-off-by: Lasse Collin <lasse.collin@tukaani.org>
    Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    lib/xz/xz_dec_stream.c | 6 +++---
    1 file changed, 3 insertions(+), 3 deletions(-)

    diff --git a/lib/xz/xz_dec_stream.c b/lib/xz/xz_dec_stream.c
    index bd1d182419d7e..0b161f90d8d80 100644
    --- a/lib/xz/xz_dec_stream.c
    +++ b/lib/xz/xz_dec_stream.c
    @@ -402,12 +402,12 @@ static enum xz_ret dec_stream_header(struct xz_dec *s)
    * we will accept other check types too, but then the check won't
    * be verified and a warning (XZ_UNSUPPORTED_CHECK) will be given.
    */
    + if (s->temp.buf[HEADER_MAGIC_SIZE + 1] > XZ_CHECK_MAX)
    + return XZ_OPTIONS_ERROR;
    +
    s->check_type = s->temp.buf[HEADER_MAGIC_SIZE + 1];

    #ifdef XZ_DEC_ANY_CHECK
    - if (s->check_type > XZ_CHECK_MAX)
    - return XZ_OPTIONS_ERROR;
    -
    if (s->check_type > XZ_CHECK_CRC32)
    return XZ_UNSUPPORTED_CHECK;
    #else
    --
    2.33.0


    \
     
     \ /
      Last update: 2021-11-15 18:44    [W:3.708 / U:0.012 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site