Changeset 455

Timestamp:

Jun 29, 2014, 7:35:55 AM (10 years ago)

Author:

katerina

Message:

Fix for ticket #354 (LZO vulnerability, does not affect samhain).

File:

• trunk/src/minilzo.c (modified) (13 diffs)

trunk/src/minilzo.c

@@ -2399 +2399 @@
 #  endif
 #  if (LZO_TEST_DECOMPRESS_OVERRUN_INPUT >= 2)
-#    define NEED_IP(x) \
-            if ((lzo_uint)(ip_end - ip) < (lzo_uint)(x))  goto input_overrun
+#    define NEED_IP(x, y) \
+    if ( ((y > 0) && (x > (LZO_UINT_MAX - y))) || ((lzo_uint)(ip_end - ip) < (lzo_uint)((x)+(y))) )  goto input_overrun
 #  endif
 #endif
@@ -2410 +2410 @@
 #  if (LZO_TEST_DECOMPRESS_OVERRUN_OUTPUT >= 2)
 #    undef TEST_OP
-#    define NEED_OP(x) \
-            if ((lzo_uint)(op_end - op) < (lzo_uint)(x))  goto output_overrun
+#    define NEED_OP(x,y) \
+    if (  ((y > 0) && (x > (LZO_UINT_MAX - y))) || ((lzo_uint)(op_end - op) < (lzo_uint)((x)+(y))) )  goto output_overrun
 #  endif
 #endif
@@ -2439 +2439 @@
 #  define HAVE_NEED_IP
 #else
-#  define NEED_IP(x)            ((void) 0)
+    /* #  define NEED_IP(x)            ((void) 0) */
+#error "no need_ip"
 #endif
 #if defined(NEED_OP)
 #  define HAVE_NEED_OP
 #else
-#  define NEED_OP(x)            ((void) 0)
+    /* #  define NEED_OP(x)            ((void) 0) */
+#error "no need_op"
 #endif
 
@@ -2513 +2515 @@
         if (t < 4)
             goto match_next;
-        assert(t > 0); NEED_OP(t); NEED_IP(t+1);
+        assert(t > 0); NEED_OP(t, 0); NEED_IP(t, 1);
         do *op++ = *ip++; while (--t > 0);
         goto first_literal_run;
@@ -2525 +2527 @@
         if (t == 0)
         {
-            NEED_IP(1);
+          NEED_IP(1, 0);
             while (*ip == 0)
             {
                 t += 255;
                 ip++;
-                NEED_IP(1);
+                NEED_IP(1, 0);
             }
             t += 15 + *ip++;
         }
-        assert(t > 0); NEED_OP(t+3); NEED_IP(t+4);
+        assert(t > 0); NEED_OP(t,3); NEED_IP(t,4);
 #if defined(LZO_UNALIGNED_OK_4) || defined(LZO_ALIGNED_OK_4)
 #if !defined(LZO_UNALIGNED_OK_4)
@@ -2591 +2593 @@
         m_pos -= *ip++ << 2;
 #endif
-        TEST_LOOKBEHIND(m_pos,out); NEED_OP(3);
+        TEST_LOOKBEHIND(m_pos,out); NEED_OP(3,0);
         *op++ = *m_pos++; *op++ = *m_pos++; *op++ = *m_pos;
 #endif
@@ -2648 +2650 @@
                 t = (t >> 5) - 1;
 #endif
-                TEST_LOOKBEHIND(m_pos,out); assert(t > 0); NEED_OP(t+3-1);
+                TEST_LOOKBEHIND(m_pos,out); assert(t > 0); NEED_OP(t,(3-1));
                 goto copy_match;
 #endif
@@ -2657 +2659 @@
                 if (t == 0)
                 {
-                    NEED_IP(1);
+                  NEED_IP(1,0);
                     while (*ip == 0)
                     {
                         t += 255;
                         ip++;
-                        NEED_IP(1);
+                        NEED_IP(1,0);
                     }
                     t += 31 + *ip++;
@@ -2701 +2703 @@
                 if (t == 0)
                 {
-                    NEED_IP(1);
+                  NEED_IP(1,0);
                     while (*ip == 0)
                     {
                         t += 255;
                         ip++;
-                        NEED_IP(1);
+                        NEED_IP(1,0);
                     }
                     t += 7 + *ip++;
@@ -2749 +2751 @@
                 m_off = 1 + (t >> 2) + (*ip++ << 2);
 #endif
-                NEED_OP(2);
+                NEED_OP(2,0);
                 t = 2; COPY_DICT(t,m_off)
 #else
@@ -2761 +2763 @@
                 m_pos -= *ip++ << 2;
 #endif
-                TEST_LOOKBEHIND(m_pos,out); NEED_OP(2);
+                TEST_LOOKBEHIND(m_pos,out); NEED_OP(2,0);
                 *op++ = *m_pos++; *op++ = *m_pos;
 #endif
@@ -2769 +2771 @@
 #if defined(COPY_DICT)
 
-            NEED_OP(t+3-1);
+            NEED_OP(t,(3-1));
             t += 3-1; COPY_DICT(t,m_off)
 
 #else
 
-            TEST_LOOKBEHIND(m_pos,out); assert(t > 0); NEED_OP(t+3-1);
+            TEST_LOOKBEHIND(m_pos,out); assert(t > 0); NEED_OP(t,(3-1));
 #if defined(LZO_UNALIGNED_OK_4) || defined(LZO_ALIGNED_OK_4)
 #if !defined(LZO_UNALIGNED_OK_4)
@@ -2812 +2814 @@
 
 match_next:
-            assert(t > 0); NEED_OP(t); NEED_IP(t+1);
+            assert(t > 0); NEED_OP(t,0); NEED_IP(t,1);
             do *op++ = *ip++; while (--t > 0);
             t = *ip++;