From owner-svn-src-vendor@FreeBSD.ORG Tue Jul 1 21:16:27 2014
Return-Path: <owner-svn-src-vendor@FreeBSD.ORG>
Delivered-To: svn-src-vendor@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org
[IPv6:2001:1900:2254:206a::19:1])
(using TLSv1 with cipher ADH-AES256-SHA (256/256 bits))
(No client certificate requested)
by hub.freebsd.org (Postfix) with ESMTPS id 9FA71135;
Tue, 1 Jul 2014 21:16:27 +0000 (UTC)
Received: from svn.freebsd.org (svn.freebsd.org
[IPv6:2001:1900:2254:2068::e6a:0])
(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
(Client did not present a certificate)
by mx1.freebsd.org (Postfix) with ESMTPS id 8CAA92F6E;
Tue, 1 Jul 2014 21:16:27 +0000 (UTC)
Received: from svn.freebsd.org ([127.0.1.70])
by svn.freebsd.org (8.14.8/8.14.8) with ESMTP id s61LGRri005084;
Tue, 1 Jul 2014 21:16:27 GMT (envelope-from delphij@svn.freebsd.org)
Received: (from delphij@localhost)
by svn.freebsd.org (8.14.8/8.14.8/Submit) id s61LGRM3005083;
Tue, 1 Jul 2014 21:16:27 GMT (envelope-from delphij@svn.freebsd.org)
Message-Id: <201407012116.s61LGRM3005083@svn.freebsd.org>
From: Xin LI <delphij@FreeBSD.org>
Date: Tue, 1 Jul 2014 21:16:27 +0000 (UTC)
To: src-committers@freebsd.org, svn-src-all@freebsd.org,
svn-src-vendor@freebsd.org
Subject: svn commit: r268120 - vendor-sys/illumos/dist/uts/common/fs/zfs
X-SVN-Group: vendor-sys
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
X-BeenThere: svn-src-vendor@freebsd.org
X-Mailman-Version: 2.1.18
Precedence: list
List-Id: SVN commit messages for the vendor work area tree
<svn-src-vendor.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/options/svn-src-vendor>,
<mailto:svn-src-vendor-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/svn-src-vendor/>
List-Post: <mailto:svn-src-vendor@freebsd.org>
List-Help: <mailto:svn-src-vendor-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/svn-src-vendor>,
<mailto:svn-src-vendor-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Tue, 01 Jul 2014 21:16:27 -0000
Author: delphij
Date: Tue Jul 1 21:16:27 2014
New Revision: 268120
URL: http://svnweb.freebsd.org/changeset/base/268120
Log:
4936 lz4 could theoretically overflow a pointer with a certain input
Reviewed by: Saso Kiselkov <skiselkov.ml@gmail.com>
Reviewed by: Keith Wesolowski <keith.wesolowski@joyent.com>
Approved by: Gordon Ross <gordon.ross@nexenta.com>
illumos/illumos-gate@58d0718061c87e3d647c891ec5281b93c08dba4e
Modified:
vendor-sys/illumos/dist/uts/common/fs/zfs/lz4.c
Modified: vendor-sys/illumos/dist/uts/common/fs/zfs/lz4.c
==============================================================================
--- vendor-sys/illumos/dist/uts/common/fs/zfs/lz4.c Tue Jul 1 21:14:35 2014 (r268119)
+++ vendor-sys/illumos/dist/uts/common/fs/zfs/lz4.c Tue Jul 1 21:16:27 2014 (r268120)
@@ -960,6 +960,9 @@ real_LZ4_uncompress(const char *source,
}
/* copy literals */
cpy = op + length;
+ /* CORNER-CASE: cpy might overflow. */
+ if (cpy < op)
+ goto _output_error; /* cpy was overflowed, bail! */
if unlikely(cpy > oend - COPYLENGTH) {
if (cpy != oend)
/* Error: we must necessarily stand at EOF */
@@ -1075,6 +1078,9 @@ LZ4_uncompress_unknownOutputSize(const c
}
/* copy literals */
cpy = op + length;
+ /* CORNER-CASE: cpy might overflow. */
+ if (cpy < op)
+ goto _output_error; /* cpy was overflowed, bail! */
if ((cpy > oend - COPYLENGTH) ||
(ip + length > iend - COPYLENGTH)) {
if (cpy > oend)