Re: [PATCHv2] lz4: fix system halted at boot kernel x86_64 compressed lz4

Greg KH
2015-04-03T18:06:18Z

On Fri, Apr 03, 2015 at 08:03:33PM +0200, Krzysztof Kolasa wrote:
> Decompression process ends with an error when loading 64bit lz4 kernel:
>
> Decoding failed
> -- System halted
>
> This condition is not needed for 64bit kernel( from the last commit d5e7caf )
>
> if( ... ||
> (op + COPYLENGTH) > oend)
> goto _output_error
>
> macro LZ4_SECURE_COPY() tests op and does not copy any data
> when op exceeds the value, decompression process is continued.
>
> added by analogy to lz4_uncompress_unknownoutputsize(...)
>
> Signed-off-by: Krzysztof Kolasa <kkolasa@winsoft.pl>
> ---
> lib/lz4/lz4_decompress.c | 12 +++++++++++-
> 1 file changed, 11 insertions(+), 1 deletion(-)
>
> diff --git a/lib/lz4/lz4_decompress.c b/lib/lz4/lz4_decompress.c
> index f0f5c5c..8a742b1 100644
> --- a/lib/lz4/lz4_decompress.c
> +++ b/lib/lz4/lz4_decompress.c
> @@ -139,8 +139,12 @@ static int lz4_uncompress(const char *source, char *dest, int osize)
> /* Error: request to write beyond destination buffer */
> if (cpy > oend)
> goto _output_error;
> +#if LZ4_ARCH64
> + if ((ref + COPYLENGTH) > oend)
> +#else
> if ((ref + COPYLENGTH) > oend ||
> (op + COPYLENGTH) > oend)
> +#endif
> goto _output_error;
> LZ4_SECURECOPY(ref, op, (oend - COPYLENGTH));
> while (op < cpy)
> @@ -270,7 +274,13 @@ static int lz4_uncompress_unknownoutputsize(const char *source, char *dest,
> if (cpy > oend - COPYLENGTH) {
> if (cpy > oend)
> goto _output_error; /* write outside of buf */
> -
> +#if LZ4_ARCH64
> + if ((ref + COPYLENGTH) > oend)
> +#else
> + if ((ref + COPYLENGTH) > oend ||
> + (op + COPYLENGTH) > oend)
> +#endif
> + goto _output_error;
> LZ4_SECURECOPY(ref, op, (oend - COPYLENGTH));
> while (op < cpy)
> *op++ = *ref++;
> --
> 2.4.0.rc0.dirty

Still all tabs turned to spaces :(