Re: [PATCHv2] lz4: fix system halted at boot kernel x86_64 compressed lz4

[Greg KH <gregkh@linuxfoundation.org>]

On Fri, Apr 03, 2015 at 08:03:33PM +0200, Krzysztof Kolasa wrote:
> Decompression process ends with an error when loading 64bit lz4 kernel:
> 
> Decoding failed
>  -- System halted
> 
> This condition is not needed for 64bit kernel( from the last commit d5e7caf )
> 
> if( ... ||
>     (op + COPYLENGTH) > oend)
>     goto _output_error
> 
> macro LZ4_SECURE_COPY() tests op and does not copy any data
> when op exceeds the value, decompression process is continued.
> 
> added by analogy to lz4_uncompress_unknownoutputsize(...)
> 
> Signed-off-by: Krzysztof Kolasa <kkolasa@winsoft.pl>
> ---
>  lib/lz4/lz4_decompress.c | 12 +++++++++++-
>  1 file changed, 11 insertions(+), 1 deletion(-)
> 
> diff --git a/lib/lz4/lz4_decompress.c b/lib/lz4/lz4_decompress.c
> index f0f5c5c..8a742b1 100644
> --- a/lib/lz4/lz4_decompress.c
> +++ b/lib/lz4/lz4_decompress.c
> @@ -139,8 +139,12 @@ static int lz4_uncompress(const char *source, char *dest, int osize)
>              /* Error: request to write beyond destination buffer */
>              if (cpy > oend)
>                  goto _output_error;
> +#if LZ4_ARCH64
> +            if ((ref + COPYLENGTH) > oend)
> +#else
>              if ((ref + COPYLENGTH) > oend ||
>                      (op + COPYLENGTH) > oend)
> +#endif
>                  goto _output_error;
>              LZ4_SECURECOPY(ref, op, (oend - COPYLENGTH));
>              while (op < cpy)
> @@ -270,7 +274,13 @@ static int lz4_uncompress_unknownoutputsize(const char *source, char *dest,
>          if (cpy > oend - COPYLENGTH) {
>              if (cpy > oend)
>                  goto _output_error; /* write outside of buf */
> -
> +#if LZ4_ARCH64
> +            if ((ref + COPYLENGTH) > oend)
> +#else
> +            if ((ref + COPYLENGTH) > oend ||
> +                    (op + COPYLENGTH) > oend)
> +#endif
> +                goto _output_error;
>              LZ4_SECURECOPY(ref, op, (oend - COPYLENGTH));
>              while (op < cpy)
>                  *op++ = *ref++;
> -- 
> 2.4.0.rc0.dirty

Still all tabs turned to spaces :(