aboutsummaryrefslogtreecommitdiff
path: root/lib
diff options
context:
space:
mode:
authorChin Liang See <chin.liang.see@intel.com>2020-06-24 16:31:08 +0800
committerTom Rini <trini@konsulko.com>2020-07-17 08:51:29 -0400
commit499b7493e7a4d8c9171ff14accafe5a5b22cf00c (patch)
tree154a93e18a9d1e2e77bbe0066ba7166736cc51b7 /lib
parentb4d14bc81ad580000277deae5d51e3e3ef09875f (diff)
downloadu-boot-499b7493e7a4d8c9171ff14accafe5a5b22cf00c.zip
u-boot-499b7493e7a4d8c9171ff14accafe5a5b22cf00c.tar.gz
u-boot-499b7493e7a4d8c9171ff14accafe5a5b22cf00c.tar.bz2
lib: zlib: Remove offset pointer optimization in inftrees.c
This fixes the CVE-2016-9840. Commit imported from [1]. inftrees.c was subtracting an offset from a pointer to an array, in order to provide a pointer that allowed indexing starting at the offset. This is not compliant with the C standard, for which the behavior of a pointer decremented before its allocated memory is undefined. Per the recommendation of a security audit of the zlib code by Trail of Bits and TrustInSoft, in support of the Mozilla Foundation, this tiny optimization was removed, in order to avoid the possibility of undefined behavior. [1]: https://github.com/madler/zlib/commit/6a043145ca6e9c55184013841a67b2fef87e44c0 Signed-off-by: Mark Adler <madler@alumni.caltech.edu> Signed-off-by: Chin Liang See <chin.liang.see@intel.com> Signed-off-by: Ley Foon Tan <ley.foon.tan@intel.com>
Diffstat (limited to 'lib')
-rw-r--r--lib/zlib/inftrees.c19
1 files changed, 8 insertions, 11 deletions
diff --git a/lib/zlib/inftrees.c b/lib/zlib/inftrees.c
index b71b969..caee502 100644
--- a/lib/zlib/inftrees.c
+++ b/lib/zlib/inftrees.c
@@ -50,7 +50,7 @@ int inflate_table(codetype type, unsigned short FAR *lens, unsigned codes,
code FAR *next; /* next available space in table */
const unsigned short FAR *base; /* base value table to use */
const unsigned short FAR *extra; /* extra bits table to use */
- int end; /* use base and extra for symbol > end */
+ unsigned match; /* use base and extra for symbol >= match */
unsigned short count[MAXBITS+1]; /* number of codes of each length */
unsigned short offs[MAXBITS+1]; /* offsets in table for each length */
static const unsigned short lbase[31] = { /* Length codes 257..285 base */
@@ -178,19 +178,17 @@ int inflate_table(codetype type, unsigned short FAR *lens, unsigned codes,
switch (type) {
case CODES:
base = extra = work; /* dummy value--not used */
- end = 19;
+ match = 20;
break;
case LENS:
base = lbase;
- base -= 257;
extra = lext;
- extra -= 257;
- end = 256;
+ match = 257;
break;
default: /* DISTS */
base = dbase;
extra = dext;
- end = -1;
+ match = 0;
}
/* initialize state for loop */
@@ -212,13 +210,12 @@ int inflate_table(codetype type, unsigned short FAR *lens, unsigned codes,
for (;;) {
/* create table entry */
this.bits = (unsigned char)(len - drop);
- if ((int)(work[sym]) < end) {
+ if (work[sym] + 1 < match) {
this.op = (unsigned char)0;
this.val = work[sym];
- }
- else if ((int)(work[sym]) > end) {
- this.op = (unsigned char)(extra[work[sym]]);
- this.val = base[work[sym]];
+ } else if (work[sym] >= match) {
+ this.op = (unsigned char)(extra[work[sym] - match]);
+ this.val = base[work[sym] - match];
}
else {
this.op = (unsigned char)(32 + 64); /* end of block */