55 lines
1.5 KiB
Diff
55 lines
1.5 KiB
Diff
|
# Commit 9143a6c55ef7e8f630857cb08c03844d372c2345
|
||
|
|
# Date 2014-08-04 13:43:03 +0200
|
||
|
|
# Author Jan Beulich <jbeulich@suse.com>
|
||
|
|
# Committer Jan Beulich <jbeulich@suse.com>
|
||
|
|
lz4: check for underruns
|
||
|
|
|
||
|
|
While overruns are already being taken care of, underruns (resulting
|
||
|
|
from overflows in the respective "op + length" (or similar) operations
|
||
|
|
weren't.
|
||
|
|
|
||
|
|
This is CVE-2014-4611.
|
||
|
|
|
||
|
|
Signed-off-by: Jan Beulich <jbeulich@suse.com>
|
||
|
|
Acked-by: Ian Campbell <ian.campbell@citrix.com>
|
||
|
|
|
||
|
|
|
||
|
|
--- a/xen/common/lz4/decompress.c
|
||
|
|
+++ b/xen/common/lz4/decompress.c
|
||
|
|
@@ -84,6 +84,8 @@ static int INIT lz4_uncompress(const uns
|
||
|
|
ip += length;
|
||
|
|
break; /* EOF */
|
||
|
|
}
|
||
|
|
+ if (unlikely((unsigned long)cpy < (unsigned long)op))
|
||
|
|
+ goto _output_error;
|
||
|
|
LZ4_WILDCOPY(ip, op, cpy);
|
||
|
|
ip -= (op - cpy);
|
||
|
|
op = cpy;
|
||
|
|
@@ -142,6 +144,8 @@ static int INIT lz4_uncompress(const uns
|
||
|
|
goto _output_error;
|
||
|
|
continue;
|
||
|
|
}
|
||
|
|
+ if (unlikely((unsigned long)cpy < (unsigned long)op))
|
||
|
|
+ goto _output_error;
|
||
|
|
LZ4_SECURECOPY(ref, op, cpy);
|
||
|
|
op = cpy; /* correction */
|
||
|
|
}
|
||
|
|
@@ -207,6 +211,8 @@ static int lz4_uncompress_unknownoutputs
|
||
|
|
op += length;
|
||
|
|
break;/* Necessarily EOF, due to parsing restrictions */
|
||
|
|
}
|
||
|
|
+ if (unlikely((unsigned long)cpy < (unsigned long)op))
|
||
|
|
+ goto _output_error;
|
||
|
|
LZ4_WILDCOPY(ip, op, cpy);
|
||
|
|
ip -= (op - cpy);
|
||
|
|
op = cpy;
|
||
|
|
@@ -270,6 +276,8 @@ static int lz4_uncompress_unknownoutputs
|
||
|
|
goto _output_error;
|
||
|
|
continue;
|
||
|
|
}
|
||
|
|
+ if (unlikely((unsigned long)cpy < (unsigned long)op))
|
||
|
|
+ goto _output_error;
|
||
|
|
LZ4_SECURECOPY(ref, op, cpy);
|
||
|
|
op = cpy; /* correction */
|
||
|
|
}
|