package/utils/busybox/patches/006-upstream_lzop_fix.patch

   1 From a9dc7c2f59dc5e92870d2d46316ea5c1f14740e3 Mon Sep 17 00:00:00 2001
   2 From: Denys Vlasenko <vda.linux@googlemail.com>
   3 Date: Mon, 30 Jun 2014 10:14:34 +0200
   4 Subject: [PATCH] lzop: add overflow check
   5
   6 See CVE-2014-4607
   7 http://www.openwall.com/lists/oss-security/2014/06/26/20
   8
   9 function                                             old     new   delta
  10 lzo1x_decompress_safe                               1010    1031     +21
  11
  12 Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
  13 ---
  14  archival/libarchive/liblzo.h  | 2 ++
  15  archival/libarchive/lzo1x_d.c | 3 +++
  16  2 files changed, 5 insertions(+)
  17
  18 --- a/archival/libarchive/liblzo.h
  19 +++ b/archival/libarchive/liblzo.h
  20 @@ -76,11 +76,13 @@
  21  #    define TEST_IP             (ip < ip_end)
  22  #    define NEED_IP(x) \
  23              if ((unsigned)(ip_end - ip) < (unsigned)(x))  goto input_overrun
  24 +#    define TEST_IV(x)          if ((x) > (unsigned)0 - (511)) goto input_overrun
  25
  26  #    undef TEST_OP              /* don't need both of the tests here */
  27  #    define TEST_OP             1
  28  #    define NEED_OP(x) \
  29              if ((unsigned)(op_end - op) < (unsigned)(x))  goto output_overrun
  30 +#    define TEST_OV(x)          if ((x) > (unsigned)0 - (511)) goto output_overrun
  31
  32  #define HAVE_ANY_OP 1
  33
  34 --- a/archival/libarchive/lzo1x_d.c
  35 +++ b/archival/libarchive/lzo1x_d.c
  36 @@ -92,6 +92,7 @@ int lzo1x_decompress_safe(const uint8_t*
  37                                 ip++;
  38                                 NEED_IP(1);
  39                         }
  40 +                       TEST_IV(t);
  41                         t += 15 + *ip++;
  42                 }
  43                 /* copy literals */
  44 @@ -224,6 +225,7 @@ int lzo1x_decompress_safe(const uint8_t*
  45                                                 ip++;
  46                                                 NEED_IP(1);
  47                                         }
  48 +                                       TEST_IV(t);
  49                                         t += 31 + *ip++;
  50                                 }
  51  #if defined(COPY_DICT)
  52 @@ -265,6 +267,7 @@ int lzo1x_decompress_safe(const uint8_t*
  53                                                 ip++;
  54                                                 NEED_IP(1);
  55                                         }
  56 +                                       TEST_IV(t);
  57                                         t += 7 + *ip++;
  58                                 }
  59  #if defined(COPY_DICT)