From mboxrd@z Thu Jan  1 00:00:00 1970
From: Ian Campbell <Ian.Campbell@eu.citrix.com>
Subject: Re: [PATCH] bunzip2: off by one in get_next_block()
Date: Wed, 28 Jan 2015 15:25:29 +0000
Message-ID: <1422458729.5187.20.camel@eu.citrix.com>
References: <54C90D4F020000780005A616@mail.emea.novell.com>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Return-path: <xen-devel-bounces@lists.xen.org>
Received: from mail6.bemta14.messagelabs.com ([193.109.254.103])
	by lists.xen.org with esmtp (Exim 4.72)
	(envelope-from <Ian.Campbell@citrix.com>) id 1YGUUp-0000k2-0R
	for xen-devel@lists.xenproject.org; Wed, 28 Jan 2015 15:25:35 +0000
In-Reply-To: <54C90D4F020000780005A616@mail.emea.novell.com>
List-Unsubscribe: <http://lists.xen.org/cgi-bin/mailman/options/xen-devel>,
	<mailto:xen-devel-request@lists.xen.org?subject=unsubscribe>
List-Post: <mailto:xen-devel@lists.xen.org>
List-Help: <mailto:xen-devel-request@lists.xen.org?subject=help>
List-Subscribe: <http://lists.xen.org/cgi-bin/mailman/listinfo/xen-devel>,
	<mailto:xen-devel-request@lists.xen.org?subject=subscribe>
Sender: xen-devel-bounces@lists.xen.org
Errors-To: xen-devel-bounces@lists.xen.org
To: Jan Beulich <JBeulich@suse.com>
Cc: xen-devel <xen-devel@lists.xenproject.org>, Keir Fraser <keir@xen.org>, Ian Jackson <Ian.Jackson@eu.citrix.com>, Dan Carpenter <dan.carpenter@oracle.com>, Tim Deegan <tim@xen.org>
List-Id: xen-devel@lists.xenproject.org

On Wed, 2015-01-28 at 15:24 +0000, Jan Beulich wrote:
> "origPtr" is used as an offset into the bd->dbuf[] array.  That array is
> allocated in start_bunzip() and has "bd->dbufSize" number of elements so
> the test here should be >= instead of >.
> 
> Later we check "origPtr" again before using it as an offset so I don't
> know if this bug can be triggered in real life.
> 
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
> 
> Trivial adjustments to make the respective Linux commit
> b5c8afe5be51078a979d86ae5ae78c4ac948063d apply to Xen.
> 
> Signed-off-by: Jan Beulich <jbeulich@suse.com>

Acked-by: Ian Campbell <ian.campbell@citrix.com>