svn commit: r268120 - vendor-sys/illumos/dist/uts/common/fs/zfs

[Xin LI]

Author: delphij
Date: Tue Jul  1 21:16:27 2014
New Revision: 268120
URL: http://svnweb.freebsd.org/changeset/base/268120

Log:
  4936 lz4 could theoretically overflow a pointer with a certain input
  Reviewed by: Saso Kiselkov <skiselkov.ml at gmail.com>
  Reviewed by: Keith Wesolowski <keith.wesolowski at joyent.com>
  Approved by: Gordon Ross <gordon.ross at nexenta.com>
  
  illumos/illumos-gate at 58d0718061c87e3d647c891ec5281b93c08dba4e

Modified:
  vendor-sys/illumos/dist/uts/common/fs/zfs/lz4.c

Modified: vendor-sys/illumos/dist/uts/common/fs/zfs/lz4.c
==============================================================================
--- vendor-sys/illumos/dist/uts/common/fs/zfs/lz4.c	Tue Jul  1 21:14:35 2014	(r268119)
+++ vendor-sys/illumos/dist/uts/common/fs/zfs/lz4.c	Tue Jul  1 21:16:27 2014	(r268120)
@@ -960,6 +960,9 @@ real_LZ4_uncompress(const char *source, 
 		}
 		/* copy literals */
 		cpy = op + length;
+		/* CORNER-CASE: cpy might overflow. */
+		if (cpy < op)
+			goto _output_error;	/* cpy was overflowed, bail! */
 		if unlikely(cpy > oend - COPYLENGTH) {
 			if (cpy != oend)
 				/* Error: we must necessarily stand at EOF */
@@ -1075,6 +1078,9 @@ LZ4_uncompress_unknownOutputSize(const c
 		}
 		/* copy literals */
 		cpy = op + length;
+		/* CORNER-CASE: cpy might overflow. */
+		if (cpy < op)
+			goto _output_error;	/* cpy was overflowed, bail! */
 		if ((cpy > oend - COPYLENGTH) ||
 		    (ip + length > iend - COPYLENGTH)) {
 			if (cpy > oend)