diff options
| author | Dan McDonald <danmcd@omniti.com> | 2014-06-23 22:25:02 -0400 |
|---|---|---|
| committer | Dan McDonald <danmcd@omniti.com> | 2014-06-26 10:46:47 -0400 |
| commit | 58d0718061c87e3d647c891ec5281b93c08dba4e (patch) | |
| tree | 0bddf8a9dd6d7dc3d32b2c83b10fe868501cc25d | |
| parent | 7802d7bf98dec568dadf72286893b1fe5abd8602 (diff) | |
| download | illumos-joyent-58d0718061c87e3d647c891ec5281b93c08dba4e.tar.gz | |
4936 lz4 could theoretically overflow a pointer with a certain input
Reviewed by: Saso Kiselkov <skiselkov.ml@gmail.com>
Reviewed by: Keith Wesolowski <keith.wesolowski@joyent.com>
Approved by: Gordon Ross <gordon.ross@nexenta.com>
| -rw-r--r-- | usr/src/grub/grub-0.97/stage2/zfs_lz4.c | 3 | ||||
| -rw-r--r-- | usr/src/uts/common/fs/zfs/lz4.c | 6 |
2 files changed, 9 insertions, 0 deletions
diff --git a/usr/src/grub/grub-0.97/stage2/zfs_lz4.c b/usr/src/grub/grub-0.97/stage2/zfs_lz4.c index 42c03f9135..6d94111538 100644 --- a/usr/src/grub/grub-0.97/stage2/zfs_lz4.c +++ b/usr/src/grub/grub-0.97/stage2/zfs_lz4.c @@ -214,6 +214,9 @@ LZ4_uncompress_unknownOutputSize(const char *source, } /* copy literals */ cpy = op + length; + /* CORNER-CASE: cpy might overflow. */ + if (cpy < op) + goto _output_error; /* cpy was overflowed, bail! */ if ((cpy > oend - COPYLENGTH) || (ip + length > iend - COPYLENGTH)) { if (cpy > oend) diff --git a/usr/src/uts/common/fs/zfs/lz4.c b/usr/src/uts/common/fs/zfs/lz4.c index 40cb0711e0..656360a6f2 100644 --- a/usr/src/uts/common/fs/zfs/lz4.c +++ b/usr/src/uts/common/fs/zfs/lz4.c @@ -960,6 +960,9 @@ real_LZ4_uncompress(const char *source, char *dest, int osize) } /* copy literals */ cpy = op + length; + /* CORNER-CASE: cpy might overflow. */ + if (cpy < op) + goto _output_error; /* cpy was overflowed, bail! */ if unlikely(cpy > oend - COPYLENGTH) { if (cpy != oend) /* Error: we must necessarily stand at EOF */ @@ -1075,6 +1078,9 @@ LZ4_uncompress_unknownOutputSize(const char *source, char *dest, int isize, } /* copy literals */ cpy = op + length; + /* CORNER-CASE: cpy might overflow. */ + if (cpy < op) + goto _output_error; /* cpy was overflowed, bail! */ if ((cpy > oend - COPYLENGTH) || (ip + length > iend - COPYLENGTH)) { if (cpy > oend) |