[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[Xen-changelog] [xen master] Revert "lzo: properly check for overruns"



commit 092978f2ffcf017b95c6ca674e629268d46222b4
Author:     Willy Tarreau <w@xxxxxx>
AuthorDate: Tue Nov 4 13:08:32 2014 +0100
Commit:     Jan Beulich <jbeulich@xxxxxxxx>
CommitDate: Tue Nov 4 13:08:32 2014 +0100

    Revert "lzo: properly check for overruns"
    
    This reverts commit 504f70b6 ("lzo: properly check for overruns").
    
    As analysed by Willem Pinckaers, this fix is still incomplete on
    certain rare corner cases, and it is easier to restart from the
    original code.
    
    Reported-by: Willem Pinckaers <willem@xxxxxxxxxxxxxx>
    Signed-off-by: Willy Tarreau <w@xxxxxx>
    [original Linux commit: af958a38]
    Signed-off-by: Jan Beulich <jbeulich@xxxxxxxx>
---
 xen/common/lzo.c |   62 ++++++++++++++++++-----------------------------------
 1 files changed, 21 insertions(+), 41 deletions(-)

diff --git a/xen/common/lzo.c b/xen/common/lzo.c
index 0bec625..7338aee 100644
--- a/xen/common/lzo.c
+++ b/xen/common/lzo.c
@@ -375,31 +375,11 @@ int lzo1x_1_compress(const unsigned char *in, size_t 
in_len,
  *  Richard Purdie <rpurdie@xxxxxxxxxxxxxx>
  */
 
-#define HAVE_IP(t, x)                              \
-    (((size_t)(ip_end - ip) >= (size_t)(t + x)) && \
-     (((t + x) >= t) && ((t + x) >= x)))
-
-#define HAVE_OP(t, x)                              \
-    (((size_t)(op_end - op) >= (size_t)(t + x)) && \
-     (((t + x) >= t) && ((t + x) >= x)))
-
-#define NEED_IP(t, x)                \
-    do {                             \
-        if (!HAVE_IP(t, x))          \
-            goto input_overrun;      \
-    } while (0)
-
-#define NEED_OP(t, x)                \
-    do {                             \
-        if (!HAVE_OP(t, x))          \
-            goto output_overrun;     \
-    } while (0)
-
-#define TEST_LB(m_pos)               \
-    do {                             \
-        if ((m_pos) < out)           \
-            goto lookbehind_overrun; \
-    } while (0)
+#define HAVE_IP(x)     ((size_t)(ip_end - ip) >= (size_t)(x))
+#define HAVE_OP(x)     ((size_t)(op_end - op) >= (size_t)(x))
+#define NEED_IP(x)     if (!HAVE_IP(x)) goto input_overrun
+#define NEED_OP(x)     if (!HAVE_OP(x)) goto output_overrun
+#define TEST_LB(m_pos) if ((m_pos) < out) goto lookbehind_overrun
 
 int lzo1x_decompress_safe(const unsigned char *in, size_t in_len,
                           unsigned char *out, size_t *out_len)
@@ -434,14 +414,14 @@ int lzo1x_decompress_safe(const unsigned char *in, size_t 
in_len,
                     while (unlikely(*ip == 0)) {
                         t += 255;
                         ip++;
-                        NEED_IP(1, 0);
+                        NEED_IP(1);
                     }
                     t += 15 + *ip++;
                 }
                 t += 3;
  copy_literal_run:
 #if defined(CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS)
-                if (likely(HAVE_IP(t, 15) && HAVE_OP(t, 15))) {
+                if (likely(HAVE_IP(t + 15) && HAVE_OP(t + 15))) {
                     const unsigned char *ie = ip + t;
                     unsigned char *oe = op + t;
                     do {
@@ -457,8 +437,8 @@ int lzo1x_decompress_safe(const unsigned char *in, size_t 
in_len,
                 } else
 #endif
                 {
-                    NEED_OP(t, 0);
-                    NEED_IP(t, 3);
+                    NEED_OP(t);
+                    NEED_IP(t + 3);
                     do {
                         *op++ = *ip++;
                     } while (--t > 0);
@@ -471,7 +451,7 @@ int lzo1x_decompress_safe(const unsigned char *in, size_t 
in_len,
                 m_pos -= t >> 2;
                 m_pos -= *ip++ << 2;
                 TEST_LB(m_pos);
-                NEED_OP(2, 0);
+                NEED_OP(2);
                 op[0] = m_pos[0];
                 op[1] = m_pos[1];
                 op += 2;
@@ -495,10 +475,10 @@ int lzo1x_decompress_safe(const unsigned char *in, size_t 
in_len,
                 while (unlikely(*ip == 0)) {
                     t += 255;
                     ip++;
-                    NEED_IP(1, 0);
+                    NEED_IP(1);
                 }
                 t += 31 + *ip++;
-                NEED_IP(2, 0);
+                NEED_IP(2);
             }
             m_pos = op - 1;
             next = get_unaligned_le16(ip);
@@ -513,10 +493,10 @@ int lzo1x_decompress_safe(const unsigned char *in, size_t 
in_len,
                 while (unlikely(*ip == 0)) {
                     t += 255;
                     ip++;
-                    NEED_IP(1, 0);
+                    NEED_IP(1);
                 }
                 t += 7 + *ip++;
-                NEED_IP(2, 0);
+                NEED_IP(2);
             }
             next = get_unaligned_le16(ip);
             ip += 2;
@@ -530,7 +510,7 @@ int lzo1x_decompress_safe(const unsigned char *in, size_t 
in_len,
 #if defined(CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS)
         if (op - m_pos >= 8) {
             unsigned char *oe = op + t;
-            if (likely(HAVE_OP(t, 15))) {
+            if (likely(HAVE_OP(t + 15))) {
                 do {
                     COPY8(op, m_pos);
                     op += 8;
@@ -540,7 +520,7 @@ int lzo1x_decompress_safe(const unsigned char *in, size_t 
in_len,
                     m_pos += 8;
                 } while (op < oe);
                 op = oe;
-                if (HAVE_IP(6, 0)) {
+                if (HAVE_IP(6)) {
                     state = next;
                     COPY4(op, ip);
                     op += next;
@@ -548,7 +528,7 @@ int lzo1x_decompress_safe(const unsigned char *in, size_t 
in_len,
                     continue;
                 }
             } else {
-                NEED_OP(t, 0);
+                NEED_OP(t);
                 do {
                     *op++ = *m_pos++;
                 } while (op < oe);
@@ -557,7 +537,7 @@ int lzo1x_decompress_safe(const unsigned char *in, size_t 
in_len,
 #endif
         {
             unsigned char *oe = op + t;
-            NEED_OP(t, 0);
+            NEED_OP(t);
             op[0] = m_pos[0];
             op[1] = m_pos[1];
             op += 2;
@@ -570,15 +550,15 @@ int lzo1x_decompress_safe(const unsigned char *in, size_t 
in_len,
         state = next;
         t = next;
 #if defined(CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS)
-        if (likely(HAVE_IP(6, 0) && HAVE_OP(4, 0))) {
+        if (likely(HAVE_IP(6) && HAVE_OP(4))) {
             COPY4(op, ip);
             op += t;
             ip += t;
         } else
 #endif
         {
-            NEED_IP(t, 3);
-            NEED_OP(t, 0);
+            NEED_IP(t + 3);
+            NEED_OP(t);
             while (t > 0) {
                 *op++ = *ip++;
                 t--;
--
generated by git-patchbot for /home/xen/git/xen.git#master

_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxx
http://lists.xensource.com/xen-changelog


 


Rackspace

Lists.xenproject.org is hosted with RackSpace, monitoring our
servers 24x7x365 and backed by RackSpace's Fanatical Support®.