From owner-svn-src-stable@freebsd.org Wed Jul 26 15:15:21 2017 Return-Path: Delivered-To: svn-src-stable@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 3CB72DC02FD; Wed, 26 Jul 2017 15:15:21 +0000 (UTC) (envelope-from mav@FreeBSD.org) Received: from repo.freebsd.org (repo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 1757D66452; Wed, 26 Jul 2017 15:15:21 +0000 (UTC) (envelope-from mav@FreeBSD.org) Received: from repo.freebsd.org ([127.0.1.37]) by repo.freebsd.org (8.15.2/8.15.2) with ESMTP id v6QFFK1F038592; Wed, 26 Jul 2017 15:15:20 GMT (envelope-from mav@FreeBSD.org) Received: (from mav@localhost) by repo.freebsd.org (8.15.2/8.15.2/Submit) id v6QFFKmc038591; Wed, 26 Jul 2017 15:15:20 GMT (envelope-from mav@FreeBSD.org) Message-Id: <201707261515.v6QFFKmc038591@repo.freebsd.org> X-Authentication-Warning: repo.freebsd.org: mav set sender to mav@FreeBSD.org using -f From: Alexander Motin Date: Wed, 26 Jul 2017 15:15:20 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-stable@freebsd.org, svn-src-stable-11@freebsd.org Subject: svn commit: r321521 - stable/11/sys/cddl/contrib/opensolaris/uts/common/fs/zfs X-SVN-Group: stable-11 X-SVN-Commit-Author: mav X-SVN-Commit-Paths: stable/11/sys/cddl/contrib/opensolaris/uts/common/fs/zfs X-SVN-Commit-Revision: 321521 X-SVN-Commit-Repository: base MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-src-stable@freebsd.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: SVN commit messages for all the -stable branches of the src tree List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 26 Jul 2017 15:15:21 -0000 Author: mav Date: Wed Jul 26 15:15:20 2017 New Revision: 321521 URL: https://svnweb.freebsd.org/changeset/base/321521 Log: MFC r305701 (by allanjude): MFV r268120: 4936 lz4 could theoretically overflow a pointer with a certain input illumos/illumos-gate@58d0718061c87e3d647c891ec5281b93c08dba4e Modified: stable/11/sys/cddl/contrib/opensolaris/uts/common/fs/zfs/lz4.c Directory Properties: stable/11/ (props changed) Modified: stable/11/sys/cddl/contrib/opensolaris/uts/common/fs/zfs/lz4.c ============================================================================== --- stable/11/sys/cddl/contrib/opensolaris/uts/common/fs/zfs/lz4.c Wed Jul 26 14:56:03 2017 (r321520) +++ stable/11/sys/cddl/contrib/opensolaris/uts/common/fs/zfs/lz4.c Wed Jul 26 15:15:20 2017 (r321521) @@ -187,21 +187,18 @@ lz4_decompress(void *s_start, void *d_start, size_t s_ defined(__amd64) || defined(__ppc64__) || defined(_WIN64) || \ defined(__LP64__) || defined(_LP64)) #define LZ4_ARCH64 1 -/* - * Illumos: On amd64 we have 20k of stack and 24k on sun4u and sun4v, so we - * can spend 16k on the algorithm - */ -/* FreeBSD: Use heap for all platforms for now */ -#define STACKLIMIT 0 #else #define LZ4_ARCH64 0 +#endif + /* - * Illumos: On i386 we only have 12k of stack, so in order to maintain the - * same COMPRESSIONLEVEL we have to use heap allocation. Performance will - * suck, but alas, it's ZFS on 32-bit we're talking about, so... + * Limits the amount of stack space that the algorithm may consume to hold + * the compression lookup table. The value `9' here means we'll never use + * more than 2k of stack (see above for a description of COMPRESSIONLEVEL). + * If more memory is needed, it is allocated from the heap. */ +/* FreeBSD: Use heap for all platforms for now */ #define STACKLIMIT 0 -#endif /* * Little Endian or Big Endian? @@ -870,7 +867,7 @@ real_LZ4_compress(const char *source, char *dest, int /* Decompression functions */ /* - * Note: The decoding functionLZ4_uncompress_unknownOutputSize() is safe + * Note: The decoding function LZ4_uncompress_unknownOutputSize() is safe * against "buffer overflow" attack type. They will never write nor * read outside of the provided output buffers. * LZ4_uncompress_unknownOutputSize() also insures that it will never @@ -913,6 +910,9 @@ LZ4_uncompress_unknownOutputSize(const char *source, c } /* copy literals */ cpy = op + length; + /* CORNER-CASE: cpy might overflow. */ + if (cpy < op) + goto _output_error; /* cpy was overflowed, bail! */ if ((cpy > oend - COPYLENGTH) || (ip + length > iend - COPYLENGTH)) { if (cpy > oend)