Print this page
4936 lz4 could theoretically overflow a pointer with a certain input


 943         unsigned token;
 944 
 945         size_t length;
 946         size_t dec32table[] = {0, 3, 2, 3, 0, 0, 0, 0};
 947 #if LZ4_ARCH64
 948         size_t dec64table[] = {0, 0, 0, (size_t)-1, 0, 1, 2, 3};
 949 #endif
 950 
 951         /* Main Loop */
 952         for (;;) {
 953                 /* get runlength */
 954                 token = *ip++;
 955                 if ((length = (token >> ML_BITS)) == RUN_MASK) {
 956                         size_t len;
 957                         for (; (len = *ip++) == 255; length += 255) {
 958                         }
 959                         length += len;
 960                 }
 961                 /* copy literals */
 962                 cpy = op + length;



 963                 if unlikely(cpy > oend - COPYLENGTH) {
 964                         if (cpy != oend)
 965                                 /* Error: we must necessarily stand at EOF */
 966                                 goto _output_error;
 967                         (void) memcpy(op, ip, length);
 968                         ip += length;
 969                         break;  /* EOF */
 970                         }
 971                 LZ4_WILDCOPY(ip, op, cpy);
 972                 ip -= (op - cpy);
 973                 op = cpy;
 974 
 975                 /* get offset */
 976                 LZ4_READ_LITTLEENDIAN_16(ref, cpy, ip);
 977                 ip += 2;
 978                 if unlikely(ref < (BYTE * const) dest)
 979                         /*
 980                          * Error: offset create reference outside destination
 981                          * buffer
 982                          */


1058 #if LZ4_ARCH64
1059         size_t dec64table[] = {0, 0, 0, (size_t)-1, 0, 1, 2, 3};
1060 #endif
1061 
1062         /* Main Loop */
1063         while (ip < iend) {
1064                 unsigned token;
1065                 size_t length;
1066 
1067                 /* get runlength */
1068                 token = *ip++;
1069                 if ((length = (token >> ML_BITS)) == RUN_MASK) {
1070                         int s = 255;
1071                         while ((ip < iend) && (s == 255)) {
1072                                 s = *ip++;
1073                                 length += s;
1074                         }
1075                 }
1076                 /* copy literals */
1077                 cpy = op + length;



1078                 if ((cpy > oend - COPYLENGTH) ||
1079                     (ip + length > iend - COPYLENGTH)) {
1080                         if (cpy > oend)
1081                                 /* Error: writes beyond output buffer */
1082                                 goto _output_error;
1083                         if (ip + length != iend)
1084                                 /*
1085                                  * Error: LZ4 format requires to consume all
1086                                  * input at this stage
1087                                  */
1088                                 goto _output_error;
1089                         (void) memcpy(op, ip, length);
1090                         op += length;
1091                         /* Necessarily EOF, due to parsing restrictions */
1092                         break;
1093                 }
1094                 LZ4_WILDCOPY(ip, op, cpy);
1095                 ip -= (op - cpy);
1096                 op = cpy;
1097 




 943         unsigned token;
 944 
 945         size_t length;
 946         size_t dec32table[] = {0, 3, 2, 3, 0, 0, 0, 0};
 947 #if LZ4_ARCH64
 948         size_t dec64table[] = {0, 0, 0, (size_t)-1, 0, 1, 2, 3};
 949 #endif
 950 
 951         /* Main Loop */
 952         for (;;) {
 953                 /* get runlength */
 954                 token = *ip++;
 955                 if ((length = (token >> ML_BITS)) == RUN_MASK) {
 956                         size_t len;
 957                         for (; (len = *ip++) == 255; length += 255) {
 958                         }
 959                         length += len;
 960                 }
 961                 /* copy literals */
 962                 cpy = op + length;
 963                 /* CORNER-CASE: cpy might overflow. */
 964                 if (cpy < op)
 965                         goto _output_error;     /* cpy was overflowed, bail! */
 966                 if unlikely(cpy > oend - COPYLENGTH) {
 967                         if (cpy != oend)
 968                                 /* Error: we must necessarily stand at EOF */
 969                                 goto _output_error;
 970                         (void) memcpy(op, ip, length);
 971                         ip += length;
 972                         break;  /* EOF */
 973                         }
 974                 LZ4_WILDCOPY(ip, op, cpy);
 975                 ip -= (op - cpy);
 976                 op = cpy;
 977 
 978                 /* get offset */
 979                 LZ4_READ_LITTLEENDIAN_16(ref, cpy, ip);
 980                 ip += 2;
 981                 if unlikely(ref < (BYTE * const) dest)
 982                         /*
 983                          * Error: offset create reference outside destination
 984                          * buffer
 985                          */


1061 #if LZ4_ARCH64
1062         size_t dec64table[] = {0, 0, 0, (size_t)-1, 0, 1, 2, 3};
1063 #endif
1064 
1065         /* Main Loop */
1066         while (ip < iend) {
1067                 unsigned token;
1068                 size_t length;
1069 
1070                 /* get runlength */
1071                 token = *ip++;
1072                 if ((length = (token >> ML_BITS)) == RUN_MASK) {
1073                         int s = 255;
1074                         while ((ip < iend) && (s == 255)) {
1075                                 s = *ip++;
1076                                 length += s;
1077                         }
1078                 }
1079                 /* copy literals */
1080                 cpy = op + length;
1081                 /* CORNER-CASE: cpy might overflow. */
1082                 if (cpy < op)
1083                         goto _output_error;     /* cpy was overflowed, bail! */
1084                 if ((cpy > oend - COPYLENGTH) ||
1085                     (ip + length > iend - COPYLENGTH)) {
1086                         if (cpy > oend)
1087                                 /* Error: writes beyond output buffer */
1088                                 goto _output_error;
1089                         if (ip + length != iend)
1090                                 /*
1091                                  * Error: LZ4 format requires to consume all
1092                                  * input at this stage
1093                                  */
1094                                 goto _output_error;
1095                         (void) memcpy(op, ip, length);
1096                         op += length;
1097                         /* Necessarily EOF, due to parsing restrictions */
1098                         break;
1099                 }
1100                 LZ4_WILDCOPY(ip, op, cpy);
1101                 ip -= (op - cpy);
1102                 op = cpy;
1103