Author: mav
Date: Wed Jul 26 15:15:20 2017
New Revision: 321521
URL: https://svnweb.freebsd.org/changeset/base/321521
Log:
MFC r305701 (by allanjude): MFV r268120:
4936 lz4 could theoretically overflow a pointer with a certain input
illumos/illumos-gate@58d0718061c87e3d647c891ec5281b93c08dba4e
Modified:
stable/11/sys/cddl/contrib/opensolaris/uts/common/fs/zfs/lz4.c
Directory Properties:
stable/11/ (props changed)
Modified: stable/11/sys/cddl/contrib/opensolaris/uts/common/fs/zfs/lz4.c
==============================================================================
--- stable/11/sys/cddl/contrib/opensolaris/uts/common/fs/zfs/lz4.c Wed Jul
26 14:56:03 2017 (r321520)
+++ stable/11/sys/cddl/contrib/opensolaris/uts/common/fs/zfs/lz4.c Wed Jul
26 15:15:20 2017 (r321521)
@@ -187,21 +187,18 @@ lz4_decompress(void *s_start, void *d_start, size_t s_
defined(__amd64) || defined(__ppc64__) || defined(_WIN64) || \
defined(__LP64__) || defined(_LP64))
#define LZ4_ARCH64 1
-/*
- * Illumos: On amd64 we have 20k of stack and 24k on sun4u and sun4v, so we
- * can spend 16k on the algorithm
- */
-/* FreeBSD: Use heap for all platforms for now */
-#define STACKLIMIT 0
#else
#define LZ4_ARCH64 0
+#endif
+
/*
- * Illumos: On i386 we only have 12k of stack, so in order to maintain the
- * same COMPRESSIONLEVEL we have to use heap allocation. Performance will
- * suck, but alas, it's ZFS on 32-bit we're talking about, so...
+ * Limits the amount of stack space that the algorithm may consume to hold
+ * the compression lookup table. The value `9' here means we'll never use
+ * more than 2k of stack (see above for a description of COMPRESSIONLEVEL).
+ * If more memory is needed, it is allocated from the heap.
*/
+/* FreeBSD: Use heap for all platforms for now */
#define STACKLIMIT 0
-#endif
/*
* Little Endian or Big Endian?
@@ -870,7 +867,7 @@ real_LZ4_compress(const char *source, char *dest, int
/* Decompression functions */
/*
- * Note: The decoding functionLZ4_uncompress_unknownOutputSize() is safe
+ * Note: The decoding function LZ4_uncompress_unknownOutputSize() is safe
* against "buffer overflow" attack type. They will never write nor
* read outside of the provided output buffers.
* LZ4_uncompress_unknownOutputSize() also insures that it will never
@@ -913,6 +910,9 @@ LZ4_uncompress_unknownOutputSize(const char *source, c
}
/* copy literals */
cpy = op + length;
+ /* CORNER-CASE: cpy might overflow. */
+ if (cpy < op)
+ goto _output_error; /* cpy was overflowed, bail! */
if ((cpy > oend - COPYLENGTH) ||
(ip + length > iend - COPYLENGTH)) {
if (cpy > oend)
_______________________________________________
svn-src-all@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/svn-src-all
To unsubscribe, send any mail to "svn-src-all-unsubscr...@freebsd.org"
