회신: LZ4 : fix the data abort issue.
If the part of the compression data are corrupted, or the compression data is totally fake, the memory access over the limit is possible. This is the log from my system usning lz4 decompression. [6502]data abort, halting [6503]r0 0x r1 0x r2 0xdcea0ffc r3 0xdcea0ffc [6509]r4 0xb9ab0bfd r5 0xdcea0ffc r6 0xdcea0ff8 r7 0xdce8 [6515]r8 0x r9 0x r10 0x r11 0xb9a98000 [6522]r12 0xdcea1000 usp 0x ulr 0x pc 0x820149bc [6528]spsr 0x41f3 and the memory addresses of some variables at the moment are ref:0xdcea0ffc, op:0xdcea0ffc, oend:0xdcea1000 As you can see, COPYLENGH is 8bytes, so @ref and @op can access the momory over @oend. Signed-off-by: JeHyeon Yeon --- lib/lz4/lz4_decompress.c |3 +++ 1 file changed, 3 insertions(+) diff --git a/lib/lz4/lz4_decompress.c b/lib/lz4/lz4_decompress.c index 7a85967..f0f5c5c 100644 --- a/lib/lz4/lz4_decompress.c +++ b/lib/lz4/lz4_decompress.c @@ -139,6 +139,9 @@ static int lz4_uncompress(const char *source, char *dest, int osize) /* Error: request to write beyond destination buffer */ if (cpy > oend) goto _output_error; + if ((ref + COPYLENGTH) > oend || + (op + COPYLENGTH) > oend) + goto _output_error; LZ4_SECURECOPY(ref, op, (oend - COPYLENGTH)); while (op < cpy) *op++ = *ref++; -- 1.7.9.5 Dear greg k-h I usually use my English name as tom. But my real name is not tom as you told me but JeHyeon Yeon. So, I changed my signed-off from tom.yeon to JeHyeon Yeon. Thank you. 보낸 사람: gre...@linuxfoundation.org [gre...@linuxfoundation.org] 보낸 날짜: 2015년 3월 13일 금요일 오후 10:23 받는 사람: Yeon, JeHyeon (Tom) 참조: linux-kernel@vger.kernel.org 제목: Re: LZ4 : fix the data abort issue. On Thu, Mar 12, 2015 at 08:28:55AM +, Yeon, JeHyeon (Tom) wrote: > If the part of the compression data are corrupted, or the compression > data is totally fake, the memory access over the limit is possible. > > This is the log from my system usning lz4 decompression. >[6502]data abort, halting >[6503]r0 0x r1 0x r2 0xdcea0ffc r3 0xdcea0ffc >[6509]r4 0xb9ab0bfd r5 0xdcea0ffc r6 0xdcea0ff8 r7 0xdce8 >[6515]r8 0x r9 0x r10 0x r11 0xb9a98000 >[6522]r12 0xdcea1000 usp 0x ulr 0x pc 0x820149bc >[6528]spsr 0x41f3 > and the memory addresses of some variables at the moment are > ref:0xdcea0ffc, op:0xdcea0ffc, oend:0xdcea1000 > > As you can see, COPYLENGH is 8bytes, so @ref and @op can access the momory > over @oend. > > Signed-off-by: tom.yeon I need a "real" name here, I somehow doubt that your government documents has your name as "tom.yeon", right? Please fix this up and resend so that I can apply it. thanks, greg k-h N떑꿩�r툤y鉉싕b쾊Ф푤v�^�)頻{.n�+돴쪐{콗喩zX㎍썳變}찠꼿쟺�:+v돣�쳭喩zZ+�+zf"톒쉱�~넮녬i鎬z�췿ⅱ�?솳鈺�&�)刪f뷌^j푹y쬶끷@A첺뛴 0띠h��뭝
회신: LZ4 : fix the data abort issue.
If the part of the compression data are corrupted, or the compression data is totally fake, the memory access over the limit is possible. This is the log from my system usning lz4 decompression. [6502]data abort, halting [6503]r0 0x r1 0x r2 0xdcea0ffc r3 0xdcea0ffc [6509]r4 0xb9ab0bfd r5 0xdcea0ffc r6 0xdcea0ff8 r7 0xdce8 [6515]r8 0x r9 0x r10 0x r11 0xb9a98000 [6522]r12 0xdcea1000 usp 0x ulr 0x pc 0x820149bc [6528]spsr 0x41f3 and the memory addresses of some variables at the moment are ref:0xdcea0ffc, op:0xdcea0ffc, oend:0xdcea1000 As you can see, COPYLENGH is 8bytes, so @ref and @op can access the momory over @oend. Signed-off-by: JeHyeon Yeon tom.y...@windriver.com --- lib/lz4/lz4_decompress.c |3 +++ 1 file changed, 3 insertions(+) diff --git a/lib/lz4/lz4_decompress.c b/lib/lz4/lz4_decompress.c index 7a85967..f0f5c5c 100644 --- a/lib/lz4/lz4_decompress.c +++ b/lib/lz4/lz4_decompress.c @@ -139,6 +139,9 @@ static int lz4_uncompress(const char *source, char *dest, int osize) /* Error: request to write beyond destination buffer */ if (cpy oend) goto _output_error; + if ((ref + COPYLENGTH) oend || + (op + COPYLENGTH) oend) + goto _output_error; LZ4_SECURECOPY(ref, op, (oend - COPYLENGTH)); while (op cpy) *op++ = *ref++; -- 1.7.9.5 Dear greg k-h I usually use my English name as tom. But my real name is not tom as you told me but JeHyeon Yeon. So, I changed my signed-off from tom.yeon to JeHyeon Yeon. Thank you. 보낸 사람: gre...@linuxfoundation.org [gre...@linuxfoundation.org] 보낸 날짜: 2015년 3월 13일 금요일 오후 10:23 받는 사람: Yeon, JeHyeon (Tom) 참조: linux-kernel@vger.kernel.org 제목: Re: LZ4 : fix the data abort issue. On Thu, Mar 12, 2015 at 08:28:55AM +, Yeon, JeHyeon (Tom) wrote: If the part of the compression data are corrupted, or the compression data is totally fake, the memory access over the limit is possible. This is the log from my system usning lz4 decompression. [6502]data abort, halting [6503]r0 0x r1 0x r2 0xdcea0ffc r3 0xdcea0ffc [6509]r4 0xb9ab0bfd r5 0xdcea0ffc r6 0xdcea0ff8 r7 0xdce8 [6515]r8 0x r9 0x r10 0x r11 0xb9a98000 [6522]r12 0xdcea1000 usp 0x ulr 0x pc 0x820149bc [6528]spsr 0x41f3 and the memory addresses of some variables at the moment are ref:0xdcea0ffc, op:0xdcea0ffc, oend:0xdcea1000 As you can see, COPYLENGH is 8bytes, so @ref and @op can access the momory over @oend. Signed-off-by: tom.yeon tom.y...@windriver.com I need a real name here, I somehow doubt that your government documents has your name as tom.yeon, right? Please fix this up and resend so that I can apply it. thanks, greg k-h N떑꿩�r툤y鉉싕b쾊Ф푤v�^�)頻{.n�+돴쪐{콗喩zX㎍썳變}찠꼿쟺�j:+v돣�쳭喩zZ+�+zf"톒쉱�~넮녬i鎬z�췿ⅱ�?솳鈺��)刪f뷌^j푹y쬶끷@A첺뛴 0띠h��뭝