linux-kernel - [PATCH 1/2] lib: decompress

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20200821162948.146947-1-paul@crapouillou.net>
Date:   Fri, 21 Aug 2020 18:29:47 +0200
From:   Paul Cercueil <paul@...pouillou.net>
To:     Nick Terrell <terrelln@...com>,
        Thomas Bogendoerfer <tsbogend@...ha.franken.de>
Cc:     linux-mips@...r.kernel.org, linux-kernel@...r.kernel.org,
        od@...c.me, Paul Cercueil <paul@...pouillou.net>
Subject: [PATCH 1/2] lib: decompress_unzstd: Limit output size

The zstd decompression code, as it is right now, will have internal
values overflow on 32-bit systems when the output size is LONG_MAX.

Until someone smarter than me can figure out how to fix the zstd code
properly, limit the destination buffer size to 512 MiB, which should be
enough for everybody, in order to make it usable on 32-bit systems.

Signed-off-by: Paul Cercueil <paul@...pouillou.net>
---
 lib/decompress_unzstd.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/lib/decompress_unzstd.c b/lib/decompress_unzstd.c
index 0ad2c15479ed..e1c03b1eaa6e 100644
--- a/lib/decompress_unzstd.c
+++ b/lib/decompress_unzstd.c
@@ -77,6 +77,7 @@
 
 #include <linux/decompress/mm.h>
 #include <linux/kernel.h>
+#include <linux/sizes.h>
 #include <linux/zstd.h>
 
 /* 128MB is the maximum window size supported by zstd. */
@@ -179,7 +180,7 @@ static int INIT __unzstd(unsigned char *in_buf, long in_len,
 	size_t ret;
 
 	if (out_len == 0)
-		out_len = LONG_MAX; /* no limit */
+		out_len = SZ_512M; /* should be big enough, right? */
 
 	if (fill == NULL && flush == NULL)
 		/*
-- 
2.28.0