• JeHyeon Yeon's avatar
    LZ4 : fix the data abort issue · 4e424152
    JeHyeon Yeon authored
    commit d5e7cafd upstream.
    
    If the part of the compression data are corrupted, or the compression
    data is totally fake, the memory access over the limit is possible.
    
    This is the log from my system usning lz4 decompression.
       [6502]data abort, halting
       [6503]r0  0x00000000 r1  0x00000000 r2  0xdcea0ffc r3  0xdcea0ffc
       [6509]r4  0xb9ab0bfd r5  0xdcea0ffc r6  0xdcea0ff8 r7  0xdce80000
       [6515]r8  0x00000000 r9  0x00000000 r10 0x00000000 r11 0xb9a98000
       [6522]r12 0xdcea1000 usp 0x00000000 ulr 0x00000000 pc  0x820149bc
       [6528]spsr 0x400001f3
    and the memory addresses of some variables at the moment are
        ref:0xdcea0ffc, op:0xdcea0ffc, oend:0xdcea1000
    
    As you can see, COPYLENGH is 8bytes, so @ref and @op can access the momory
    over @oend.
    Signed-off-by: default avatarJeHyeon Yeon <tom.yeon@windriver.com>
    Reviewed-by: default avatarDavid Sterba <dsterba@suse.cz>
    Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
    Signed-off-by: default avatarLuis Henriques <luis.henriques@canonical.com>
    4e424152
lz4_decompress.c 7.92 KB