* [PATCH 2/3] lz4: ensure length does not wrap
@ 2014-07-01 21:22 Holger Schurig
0 siblings, 0 replies; only message in thread
From: Holger Schurig @ 2014-07-01 21:22 UTC (permalink / raw)
To: barebox; +Cc: Holger Schurig
Note: this is the same as 206204a1162b995e2185275167b22468c00d6b36 in
linux-git.
Given some pathologically compressed data, lz4 could possibly decide to
wrap a few internal variables, causing unknown things to happen. Catch
this before the wrapping happens and abort the decompression.
Reported-by: "Don A. Bailey" <donb@securitymouse.com>
Signed-off-by: Holger Schurig <holgerschurig@gmail.de>
---
lib/lz4/lz4_decompress.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/lib/lz4/lz4_decompress.c b/lib/lz4/lz4_decompress.c
index 8e64ce6..75cf08b 100644
--- a/lib/lz4/lz4_decompress.c
+++ b/lib/lz4/lz4_decompress.c
@@ -73,6 +73,8 @@ static int lz4_uncompress(const char *source, char *dest, int osize)
len = *ip++;
for (; len == 255; length += 255)
len = *ip++;
+ if (unlikely(length > (size_t)(length + len)))
+ goto _output_error;
length += len;
}
--
1.8.5.2
_______________________________________________
barebox mailing list
barebox@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/barebox
^ permalink raw reply [flat|nested] only message in thread
only message in thread, other threads:[~2014-07-01 21:22 UTC | newest]
Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2014-07-01 21:22 [PATCH 2/3] lz4: ensure length does not wrap Holger Schurig
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox