Print this page
4936 lz4 could theoretically overflow a pointer with a certain input

Split Close
Expand all
Collapse all
          --- old/usr/src/uts/common/fs/zfs/lz4.c
          +++ new/usr/src/uts/common/fs/zfs/lz4.c
↓ open down ↓ 952 lines elided ↑ open up ↑
 953  953                  /* get runlength */
 954  954                  token = *ip++;
 955  955                  if ((length = (token >> ML_BITS)) == RUN_MASK) {
 956  956                          size_t len;
 957  957                          for (; (len = *ip++) == 255; length += 255) {
 958  958                          }
 959  959                          length += len;
 960  960                  }
 961  961                  /* copy literals */
 962  962                  cpy = op + length;
      963 +                /* CORNER-CASE: cpy might overflow. */
      964 +                if (cpy < op)
      965 +                        goto _output_error;     /* cpy was overflowed, bail! */
 963  966                  if unlikely(cpy > oend - COPYLENGTH) {
 964  967                          if (cpy != oend)
 965  968                                  /* Error: we must necessarily stand at EOF */
 966  969                                  goto _output_error;
 967  970                          (void) memcpy(op, ip, length);
 968  971                          ip += length;
 969  972                          break;  /* EOF */
 970  973                          }
 971  974                  LZ4_WILDCOPY(ip, op, cpy);
 972  975                  ip -= (op - cpy);
↓ open down ↓ 95 lines elided ↑ open up ↑
1068 1071                  token = *ip++;
1069 1072                  if ((length = (token >> ML_BITS)) == RUN_MASK) {
1070 1073                          int s = 255;
1071 1074                          while ((ip < iend) && (s == 255)) {
1072 1075                                  s = *ip++;
1073 1076                                  length += s;
1074 1077                          }
1075 1078                  }
1076 1079                  /* copy literals */
1077 1080                  cpy = op + length;
     1081 +                /* CORNER-CASE: cpy might overflow. */
     1082 +                if (cpy < op)
     1083 +                        goto _output_error;     /* cpy was overflowed, bail! */
1078 1084                  if ((cpy > oend - COPYLENGTH) ||
1079 1085                      (ip + length > iend - COPYLENGTH)) {
1080 1086                          if (cpy > oend)
1081 1087                                  /* Error: writes beyond output buffer */
1082 1088                                  goto _output_error;
1083 1089                          if (ip + length != iend)
1084 1090                                  /*
1085 1091                                   * Error: LZ4 format requires to consume all
1086 1092                                   * input at this stage
1087 1093                                   */
↓ open down ↓ 81 lines elided ↑ open up ↑
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX