[PATCH] bunzip2: off by one in get_next_block()

[PATCH] bunzip2: off by one in get_next_block()

[Jan Beulich]

[-- Attachment #1: Type: text/plain, Size: 986 bytes --]

"origPtr" is used as an offset into the bd->dbuf[] array.  That array is
allocated in start_bunzip() and has "bd->dbufSize" number of elements so
the test here should be >= instead of >.

Later we check "origPtr" again before using it as an offset so I don't
know if this bug can be triggered in real life.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>

Trivial adjustments to make the respective Linux commit
b5c8afe5be51078a979d86ae5ae78c4ac948063d apply to Xen.

Signed-off-by: Jan Beulich <jbeulich@suse.com>

--- a/xen/common/bunzip2.c
+++ b/xen/common/bunzip2.c
@@ -174,7 +174,7 @@ static int INIT get_next_block(struct bu
 	if (get_bits(bd, 1))
 		return RETVAL_OBSOLETE_INPUT;
 	origPtr = get_bits(bd, 24);
-	if (origPtr > dbufSize)
+	if (origPtr >= dbufSize)
 		return RETVAL_DATA_ERROR;
 	/* mapping table: if some byte values are never used (encoding things
 	   like ascii text), the compression code removes the gaps to have fewer




[-- Attachment #2: bunzip2-off-by-one.patch --]
[-- Type: text/plain, Size: 1023 bytes --]

bunzip2: off by one in get_next_block()

"origPtr" is used as an offset into the bd->dbuf[] array.  That array is
allocated in start_bunzip() and has "bd->dbufSize" number of elements so
the test here should be >= instead of >.

Later we check "origPtr" again before using it as an offset so I don't
know if this bug can be triggered in real life.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>

Trivial adjustments to make the respective Linux commit
b5c8afe5be51078a979d86ae5ae78c4ac948063d apply to Xen.

Signed-off-by: Jan Beulich <jbeulich@suse.com>

--- a/xen/common/bunzip2.c
+++ b/xen/common/bunzip2.c
@@ -174,7 +174,7 @@ static int INIT get_next_block(struct bu
 	if (get_bits(bd, 1))
 		return RETVAL_OBSOLETE_INPUT;
 	origPtr = get_bits(bd, 24);
-	if (origPtr > dbufSize)
+	if (origPtr >= dbufSize)
 		return RETVAL_DATA_ERROR;
 	/* mapping table: if some byte values are never used (encoding things
 	   like ascii text), the compression code removes the gaps to have fewer

[-- Attachment #3: Type: text/plain, Size: 126 bytes --]

_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xen.org
http://lists.xen.org/xen-devel

Re: [PATCH] bunzip2: off by one in get_next_block()

[Ian Campbell]

On Wed, 2015-01-28 at 15:24 +0000, Jan Beulich wrote:
> "origPtr" is used as an offset into the bd->dbuf[] array.  That array is
> allocated in start_bunzip() and has "bd->dbufSize" number of elements so
> the test here should be >= instead of >.
> 
> Later we check "origPtr" again before using it as an offset so I don't
> know if this bug can be triggered in real life.
> 
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
> 
> Trivial adjustments to make the respective Linux commit
> b5c8afe5be51078a979d86ae5ae78c4ac948063d apply to Xen.
> 
> Signed-off-by: Jan Beulich <jbeulich@suse.com>

Acked-by: Ian Campbell <ian.campbell@citrix.com>