Author: delphij
Date: Tue Jul 1 21:16:27 2014
New Revision: 268120
URL: http://svnweb.freebsd.org/changeset/base/268120
Log:
4936 lz4 could theoretically overflow a pointer with a certain input
Reviewed by: Saso Kiselkov <skiselkov...@gmail.com>
Reviewed by: Keith Wesolowski <keith.wesolow...@joyent.com>
Approved by: Gordon Ross <gordon.r...@nexenta.com>
illumos/illumos-gate@58d0718061c87e3d647c891ec5281b93c08dba4e
Modified:
vendor-sys/illumos/dist/uts/common/fs/zfs/lz4.c
Modified: vendor-sys/illumos/dist/uts/common/fs/zfs/lz4.c
==============================================================================
--- vendor-sys/illumos/dist/uts/common/fs/zfs/lz4.c Tue Jul 1 21:14:35
2014 (r268119)
+++ vendor-sys/illumos/dist/uts/common/fs/zfs/lz4.c Tue Jul 1 21:16:27
2014 (r268120)
@@ -960,6 +960,9 @@ real_LZ4_uncompress(const char *source,
}
/* copy literals */
cpy = op + length;
+ /* CORNER-CASE: cpy might overflow. */
+ if (cpy < op)
+ goto _output_error; /* cpy was overflowed, bail! */
if unlikely(cpy > oend - COPYLENGTH) {
if (cpy != oend)
/* Error: we must necessarily stand at EOF */
@@ -1075,6 +1078,9 @@ LZ4_uncompress_unknownOutputSize(const c
}
/* copy literals */
cpy = op + length;
+ /* CORNER-CASE: cpy might overflow. */
+ if (cpy < op)
+ goto _output_error; /* cpy was overflowed, bail! */
if ((cpy > oend - COPYLENGTH) ||
(ip + length > iend - COPYLENGTH)) {
if (cpy > oend)
_______________________________________________
svn-src-all@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/svn-src-all
To unsubscribe, send any mail to "svn-src-all-unsubscr...@freebsd.org"
