Commit Graph

8 Commits

Author SHA1 Message Date
Simon Glass
f6eec89fa3 lzma: fix buffer bound check error further
Commit 4d3b8a0d fixed a problem with lzma decompress where it would
run out of bytes to decompress. The algorithm needs to know how many
uncompressed bytes it is expected to produce.

However, the fix introduced a potential buffer overrun, and causes
the compression test to fail (test_compression command in sandbox).

The correct fix seems to be to use the minimum of the expected number
of uncompressed bytes and the amount of output space available. That
way things work normally when there is enough space, and return an
error (without overrunning available space) when there is not.

Signed-off-by: Antonios Vamporakis <ant@area128.com>
CC: Kees Cook <keescook@chromium.org>
CC: Simon Glass <sjg@chromium.org>
CC: Daniel Schwierzeck <daniel.schwierzeck@gmail.com>
CC: Luka Perkov <luka@openwrt.org>

Signed-off-by: Simon Glass <sjg@chromium.org>
2015-01-14 11:35:43 -05:00
Jeroen Hofstee
867abdac5e LzmaTools: don't self assign values
It seems the code tries to trick the compiler the argument
is actually used. However compilers became too smart to
fool them so easily an now warn. Gcc and clang don't seem
to emit a warning when the argument is unused. If so it
should be decorated with unused / (void).

Signed-off-by: Jeroen Hofstee <jeroen@myspectrum.nl>
2014-06-11 16:27:06 -04:00
Antonios Vamporakis
4d3b8a0d1b lzma: fix buffer bound check error
Variable uncompressedSize references the space available, while outSizeFull is
the actual expected uncompressed size. Using the wrong value causes LzmaDecode
to return SZ_ERROR_INPUT_EOF. Problem was introduced in commit afca294. While
at it add additional debug message.

Signed-off-by: Antonios Vamporakis <ant@area128.com>
CC: Kees Cook <keescook@chromium.org>
CC: Simon Glass <sjg@chromium.org>
CC: Daniel Schwierzeck <daniel.schwierzeck@gmail.com>
CC: Luka Perkov <luka@openwrt.org>
2014-01-14 09:01:05 -05:00
Kees Cook
afca294289 lzma: correctly bounds-check output buffer
The output buffer size must be correctly passed to the lzma decoder or
there is a risk of overflowing memory during decompression. Switching
to the LZMA_FINISH_END mode means nothing is left in an unknown state
once the buffer becomes full.

Signed-off-by: Kees Cook <keescook@chromium.org>
Acked-by: Simon Glass <sjg@chromium.org>
2013-09-03 13:30:21 -06:00
Wolfgang Denk
1a4596601f Add GPL-2.0+ SPDX-License-Identifier to source files
Signed-off-by: Wolfgang Denk <wd@denx.de>
[trini: Fixup common/cmd_io.c]
Signed-off-by: Tom Rini <trini@ti.com>
2013-07-24 09:44:38 -04:00
Mike Frysinger
f3e6110a10 lzma: fix printf warnings
Fix size_t printf format warnings:

LzmaTools.c: In function 'lzmaBuffToBuffDecompress':
LzmaTools.c:110:5: warning: format '%x' expects type 'unsigned int',
                            but argument 2 has type 'SizeT'
LzmaTools.c:111:5: warning: format '%x' expects type 'unsigned int',
                            but argument 2 has type 'SizeT'

Signed-off-by: Mike Frysinger <vapier@gentoo.org>
2012-03-28 09:54:08 +02:00
Marek Vasut
dd0598420c GCC4.6: Squash warnings in LzmaTools.c
LzmaTools.c: In function 'lzmaBuffToBuffDecompress':
LzmaTools.c:70:5: warning: format '%lx' expects type 'long unsigned int', but
argument 2 has type 'unsigned char *'
LzmaTools.c:71:5: warning: format '%lx' expects type 'long unsigned int', but
argument 2 has type 'unsigned char *'
LzmaTools.c:72:5: warning: format '%lx' expects type 'long unsigned int', but
argument 2 has type 'unsigned char *'
LzmaTools.c:73:5: warning: format '%lx' expects type 'long unsigned int', but
argument 2 has type 'unsigned char *'
LzmaTools.c:74:5: warning: format '%lx' expects type 'long unsigned int', but
argument 2 has type 'unsigned char *'
LzmaTools.c:110:5: warning: format '%lx' expects type 'long unsigned int', but
argument 2 has type 'SizeT'
LzmaTools.c:111:5: warning: format '%lx' expects type 'long unsigned int', but
argument 2 has type 'SizeT'

Signed-off-by: Marek Vasut <marek.vasut@gmail.com>
Cc: Wolfgang Denk <wd@denx.de>
Cc: Simon Glass <sjg@chromium.org>
Cc: Mike Frysinger <vapier@gentoo.org>
2011-10-27 23:54:08 +02:00
Peter Tyser
78acc472d9 Rename lib_generic/ to lib/
Now that the other architecture-specific lib directories have been
moved out of the top-level directory there's not much reason to have the
'_generic' suffix on the common lib directory.

Signed-off-by: Peter Tyser <ptyser@xes-inc.com>
2010-04-13 09:13:04 +02:00