mirror of
https://github.com/brain-hackers/u-boot-brain
synced 2024-08-24 10:58:52 +09:00
![Kees Cook](/assets/img/avatar_default.png)
This checks the size of the output buffer and fails if it was going to overflow the buffer during lzo decompression. Signed-off-by: Kees Cook <keescook@chromium.org> Acked-by: Simon Glass <sjg@chromium.org>
338 lines
6.6 KiB
C
338 lines
6.6 KiB
C
/*
|
|
* LZO1X Decompressor from MiniLZO
|
|
*
|
|
* Copyright (C) 1996-2005 Markus F.X.J. Oberhumer <markus@oberhumer.com>
|
|
*
|
|
* The full LZO package can be found at:
|
|
* http://www.oberhumer.com/opensource/lzo/
|
|
*
|
|
* Changed for kernel use by:
|
|
* Nitin Gupta <nitingupta910@gmail.com>
|
|
* Richard Purdie <rpurdie@openedhand.com>
|
|
*/
|
|
|
|
#include <common.h>
|
|
#include <linux/lzo.h>
|
|
#include <asm/byteorder.h>
|
|
#include <asm/unaligned.h>
|
|
#include "lzodefs.h"
|
|
|
|
#define HAVE_IP(x, ip_end, ip) ((size_t)(ip_end - ip) < (x))
|
|
#define HAVE_OP(x, op_end, op) ((size_t)(op_end - op) < (x))
|
|
#define HAVE_LB(m_pos, out, op) (m_pos < out || m_pos >= op)
|
|
|
|
#define COPY4(dst, src) \
|
|
put_unaligned(get_unaligned((const u32 *)(src)), (u32 *)(dst))
|
|
|
|
static const unsigned char lzop_magic[] = {
|
|
0x89, 0x4c, 0x5a, 0x4f, 0x00, 0x0d, 0x0a, 0x1a, 0x0a
|
|
};
|
|
|
|
#define HEADER_HAS_FILTER 0x00000800L
|
|
|
|
static inline const unsigned char *parse_header(const unsigned char *src)
|
|
{
|
|
u16 version;
|
|
int i;
|
|
|
|
/* read magic: 9 first bytes */
|
|
for (i = 0; i < ARRAY_SIZE(lzop_magic); i++) {
|
|
if (*src++ != lzop_magic[i])
|
|
return NULL;
|
|
}
|
|
/* get version (2bytes), skip library version (2),
|
|
* 'need to be extracted' version (2) and
|
|
* method (1) */
|
|
version = get_unaligned_be16(src);
|
|
src += 7;
|
|
if (version >= 0x0940)
|
|
src++;
|
|
if (get_unaligned_be32(src) & HEADER_HAS_FILTER)
|
|
src += 4; /* filter info */
|
|
|
|
/* skip flags, mode and mtime_low */
|
|
src += 12;
|
|
if (version >= 0x0940)
|
|
src += 4; /* skip mtime_high */
|
|
|
|
i = *src++;
|
|
/* don't care about the file name, and skip checksum */
|
|
src += i + 4;
|
|
|
|
return src;
|
|
}
|
|
|
|
int lzop_decompress(const unsigned char *src, size_t src_len,
|
|
unsigned char *dst, size_t *dst_len)
|
|
{
|
|
unsigned char *start = dst;
|
|
const unsigned char *send = src + src_len;
|
|
u32 slen, dlen;
|
|
size_t tmp, remaining;
|
|
int r;
|
|
|
|
src = parse_header(src);
|
|
if (!src)
|
|
return LZO_E_ERROR;
|
|
|
|
remaining = *dst_len;
|
|
while (src < send) {
|
|
/* read uncompressed block size */
|
|
dlen = get_unaligned_be32(src);
|
|
src += 4;
|
|
|
|
/* exit if last block */
|
|
if (dlen == 0) {
|
|
*dst_len = dst - start;
|
|
return LZO_E_OK;
|
|
}
|
|
|
|
/* read compressed block size, and skip block checksum info */
|
|
slen = get_unaligned_be32(src);
|
|
src += 8;
|
|
|
|
if (slen <= 0 || slen > dlen)
|
|
return LZO_E_ERROR;
|
|
|
|
/* abort if buffer ran out of room */
|
|
if (dlen > remaining)
|
|
return LZO_E_OUTPUT_OVERRUN;
|
|
|
|
/* decompress */
|
|
tmp = dlen;
|
|
r = lzo1x_decompress_safe((u8 *) src, slen, dst, &tmp);
|
|
|
|
if (r != LZO_E_OK)
|
|
return r;
|
|
|
|
if (dlen != tmp)
|
|
return LZO_E_ERROR;
|
|
|
|
src += slen;
|
|
dst += dlen;
|
|
remaining -= dlen;
|
|
}
|
|
|
|
return LZO_E_INPUT_OVERRUN;
|
|
}
|
|
|
|
int lzo1x_decompress_safe(const unsigned char *in, size_t in_len,
|
|
unsigned char *out, size_t *out_len)
|
|
{
|
|
const unsigned char * const ip_end = in + in_len;
|
|
unsigned char * const op_end = out + *out_len;
|
|
const unsigned char *ip = in, *m_pos;
|
|
unsigned char *op = out;
|
|
size_t t;
|
|
|
|
*out_len = 0;
|
|
|
|
if (*ip > 17) {
|
|
t = *ip++ - 17;
|
|
if (t < 4)
|
|
goto match_next;
|
|
if (HAVE_OP(t, op_end, op))
|
|
goto output_overrun;
|
|
if (HAVE_IP(t + 1, ip_end, ip))
|
|
goto input_overrun;
|
|
do {
|
|
*op++ = *ip++;
|
|
} while (--t > 0);
|
|
goto first_literal_run;
|
|
}
|
|
|
|
while ((ip < ip_end)) {
|
|
t = *ip++;
|
|
if (t >= 16)
|
|
goto match;
|
|
if (t == 0) {
|
|
if (HAVE_IP(1, ip_end, ip))
|
|
goto input_overrun;
|
|
while (*ip == 0) {
|
|
t += 255;
|
|
ip++;
|
|
if (HAVE_IP(1, ip_end, ip))
|
|
goto input_overrun;
|
|
}
|
|
t += 15 + *ip++;
|
|
}
|
|
if (HAVE_OP(t + 3, op_end, op))
|
|
goto output_overrun;
|
|
if (HAVE_IP(t + 4, ip_end, ip))
|
|
goto input_overrun;
|
|
|
|
COPY4(op, ip);
|
|
op += 4;
|
|
ip += 4;
|
|
if (--t > 0) {
|
|
if (t >= 4) {
|
|
do {
|
|
COPY4(op, ip);
|
|
op += 4;
|
|
ip += 4;
|
|
t -= 4;
|
|
} while (t >= 4);
|
|
if (t > 0) {
|
|
do {
|
|
*op++ = *ip++;
|
|
} while (--t > 0);
|
|
}
|
|
} else {
|
|
do {
|
|
*op++ = *ip++;
|
|
} while (--t > 0);
|
|
}
|
|
}
|
|
|
|
first_literal_run:
|
|
t = *ip++;
|
|
if (t >= 16)
|
|
goto match;
|
|
m_pos = op - (1 + M2_MAX_OFFSET);
|
|
m_pos -= t >> 2;
|
|
m_pos -= *ip++ << 2;
|
|
|
|
if (HAVE_LB(m_pos, out, op))
|
|
goto lookbehind_overrun;
|
|
|
|
if (HAVE_OP(3, op_end, op))
|
|
goto output_overrun;
|
|
*op++ = *m_pos++;
|
|
*op++ = *m_pos++;
|
|
*op++ = *m_pos;
|
|
|
|
goto match_done;
|
|
|
|
do {
|
|
match:
|
|
if (t >= 64) {
|
|
m_pos = op - 1;
|
|
m_pos -= (t >> 2) & 7;
|
|
m_pos -= *ip++ << 3;
|
|
t = (t >> 5) - 1;
|
|
if (HAVE_LB(m_pos, out, op))
|
|
goto lookbehind_overrun;
|
|
if (HAVE_OP(t + 3 - 1, op_end, op))
|
|
goto output_overrun;
|
|
goto copy_match;
|
|
} else if (t >= 32) {
|
|
t &= 31;
|
|
if (t == 0) {
|
|
if (HAVE_IP(1, ip_end, ip))
|
|
goto input_overrun;
|
|
while (*ip == 0) {
|
|
t += 255;
|
|
ip++;
|
|
if (HAVE_IP(1, ip_end, ip))
|
|
goto input_overrun;
|
|
}
|
|
t += 31 + *ip++;
|
|
}
|
|
m_pos = op - 1;
|
|
m_pos -= get_unaligned_le16(ip) >> 2;
|
|
ip += 2;
|
|
} else if (t >= 16) {
|
|
m_pos = op;
|
|
m_pos -= (t & 8) << 11;
|
|
|
|
t &= 7;
|
|
if (t == 0) {
|
|
if (HAVE_IP(1, ip_end, ip))
|
|
goto input_overrun;
|
|
while (*ip == 0) {
|
|
t += 255;
|
|
ip++;
|
|
if (HAVE_IP(1, ip_end, ip))
|
|
goto input_overrun;
|
|
}
|
|
t += 7 + *ip++;
|
|
}
|
|
m_pos -= get_unaligned_le16(ip) >> 2;
|
|
ip += 2;
|
|
if (m_pos == op)
|
|
goto eof_found;
|
|
m_pos -= 0x4000;
|
|
} else {
|
|
m_pos = op - 1;
|
|
m_pos -= t >> 2;
|
|
m_pos -= *ip++ << 2;
|
|
|
|
if (HAVE_LB(m_pos, out, op))
|
|
goto lookbehind_overrun;
|
|
if (HAVE_OP(2, op_end, op))
|
|
goto output_overrun;
|
|
|
|
*op++ = *m_pos++;
|
|
*op++ = *m_pos;
|
|
goto match_done;
|
|
}
|
|
|
|
if (HAVE_LB(m_pos, out, op))
|
|
goto lookbehind_overrun;
|
|
if (HAVE_OP(t + 3 - 1, op_end, op))
|
|
goto output_overrun;
|
|
|
|
if (t >= 2 * 4 - (3 - 1) && (op - m_pos) >= 4) {
|
|
COPY4(op, m_pos);
|
|
op += 4;
|
|
m_pos += 4;
|
|
t -= 4 - (3 - 1);
|
|
do {
|
|
COPY4(op, m_pos);
|
|
op += 4;
|
|
m_pos += 4;
|
|
t -= 4;
|
|
} while (t >= 4);
|
|
if (t > 0)
|
|
do {
|
|
*op++ = *m_pos++;
|
|
} while (--t > 0);
|
|
} else {
|
|
copy_match:
|
|
*op++ = *m_pos++;
|
|
*op++ = *m_pos++;
|
|
do {
|
|
*op++ = *m_pos++;
|
|
} while (--t > 0);
|
|
}
|
|
match_done:
|
|
t = ip[-2] & 3;
|
|
if (t == 0)
|
|
break;
|
|
match_next:
|
|
if (HAVE_OP(t, op_end, op))
|
|
goto output_overrun;
|
|
if (HAVE_IP(t + 1, ip_end, ip))
|
|
goto input_overrun;
|
|
|
|
*op++ = *ip++;
|
|
if (t > 1) {
|
|
*op++ = *ip++;
|
|
if (t > 2)
|
|
*op++ = *ip++;
|
|
}
|
|
|
|
t = *ip++;
|
|
} while (ip < ip_end);
|
|
}
|
|
|
|
*out_len = op - out;
|
|
return LZO_E_EOF_NOT_FOUND;
|
|
|
|
eof_found:
|
|
*out_len = op - out;
|
|
return (ip == ip_end ? LZO_E_OK :
|
|
(ip < ip_end ? LZO_E_INPUT_NOT_CONSUMED : LZO_E_INPUT_OVERRUN));
|
|
input_overrun:
|
|
*out_len = op - out;
|
|
return LZO_E_INPUT_OVERRUN;
|
|
|
|
output_overrun:
|
|
*out_len = op - out;
|
|
return LZO_E_OUTPUT_OVERRUN;
|
|
|
|
lookbehind_overrun:
|
|
*out_len = op - out;
|
|
return LZO_E_LOOKBEHIND_OVERRUN;
|
|
}
|