Re: [PATCH 3.15 49/61] lz4: ensure length does not wrap

[Greg Kroah-Hartman]

On Tue, Jun 24, 2014 at 10:28:31AM -0600, Don A. Bailey wrote:
> Objection. Patch needs slight adjustment. Emailing separately.
> 

Dragging this back to lkml, here's a proposed patch for this, I'll write
it up for "real" and submit it tomorrow.

thanks,

greg k-h

--------------------------
From: Greg Kroah-Hartman <gre...@linuxfoundation.org>
Subject: lz4: add additional checks



diff --git a/lib/lz4/lz4_decompress.c b/lib/lz4/lz4_decompress.c
index 99a03acb7d47..b74da447e81e 100644
--- a/lib/lz4/lz4_decompress.c
+++ b/lib/lz4/lz4_decompress.c
@@ -108,6 +108,8 @@ static int lz4_uncompress(const char *source, char *dest, 
int osize)
                if (length == ML_MASK) {
                        for (; *ip == 255; length += 255)
                                ip++;
+                       if (unlikely(length > (size_t)(length + *ip)))
+                               goto _output_error;
                        length += *ip++;
                }
 
@@ -157,7 +159,7 @@ static int lz4_uncompress(const char *source, char *dest, 
int osize)
 
        /* write overflow error detected */
 _output_error:
-       return (int) (-(((char *)ip) - source));
+       return -1;
 }
 
 static int lz4_uncompress_unknownoutputsize(const char *source, char *dest,
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/