lk/linux-kernel-test
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

lzma/gzip: fix potential oops when input data is truncated

Browse Source 
If the lzma/gzip decompressors are called with insufficient input data
(len > 0 & fill = NULL), they will attempt to call the fill function to
obtain more data, leading to a kernel oops.

Signed-off-by: Phillip Lougher <phillip@lougher.demon.co.uk>
Cc: "H. Peter Anvin" <hpa@zytor.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
This commit is contained in:
Phillip Lougher
2009-09-23 15:57:37 -07:00
committed by Linus Torvalds
parent 3354f73b24
commit 6a8811629e
2 changed files with 17 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
lib/decompress_inflate.c
View File

@@ -27,6 +27,11 @@
#define GZIP_IOBUF_SIZE (16*1024) #define GZIP_IOBUF_SIZE (16*1024)
static int nofill(void *buffer, unsigned int len)
{
return -1;
}
/* Included from initramfs et al code */ /* Included from initramfs et al code */
STATIC int INIT gunzip(unsigned char *buf, int len, STATIC int INIT gunzip(unsigned char *buf, int len,
int(*fill)(void*, unsigned int), int(*fill)(void*, unsigned int),
@@ -76,6 +81,9 @@ STATIC int INIT gunzip(unsigned char *buf, int len,
goto gunzip_nomem4; goto gunzip_nomem4;
} }
if (!fill)
fill = nofill;
if (len == 0) if (len == 0)
len = fill(zbuf, GZIP_IOBUF_SIZE); len = fill(zbuf, GZIP_IOBUF_SIZE);

10
lib/decompress_unlzma.c
View File

@@ -82,6 +82,11 @@ struct rc {
#define RC_MODEL_TOTAL_BITS 11 #define RC_MODEL_TOTAL_BITS 11
static int nofill(void *buffer, unsigned int len)
{
return -1;
}
/* Called twice: once at startup and once in rc_normalize() */ /* Called twice: once at startup and once in rc_normalize() */
static void INIT rc_read(struct rc *rc) static void INIT rc_read(struct rc *rc)
{ {
@@ -97,7 +102,10 @@ static inline void INIT rc_init(struct rc *rc,
int (*fill)(void*, unsigned int), int (*fill)(void*, unsigned int),
char *buffer, int buffer_size) char *buffer, int buffer_size)
{ {
rc->fill = fill; if (fill)
rc->fill = fill;
else
rc->fill = nofill;
rc->buffer = (uint8_t *)buffer; rc->buffer = (uint8_t *)buffer;
rc->buffer_size = buffer_size; rc->buffer_size = buffer_size;
rc->buffer_end = rc->buffer + rc->buffer_size; rc->buffer_end = rc->buffer + rc->buffer_size;