| From abf3b6cc7c03eb3b170622949339685f8937aa81 Mon Sep 17 00:00:00 2001 |
| From: Sasha Levin <sashal@kernel.org> |
| Date: Mon, 11 Oct 2021 05:31:40 +0800 |
| Subject: lib/xz: Validate the value before assigning it to an enum variable |
| |
| From: Lasse Collin <lasse.collin@tukaani.org> |
| |
| [ Upstream commit 4f8d7abaa413c34da9d751289849dbfb7c977d05 ] |
| |
| This might matter, for example, if the underlying type of enum xz_check |
| was a signed char. In such a case the validation wouldn't have caught an |
| unsupported header. I don't know if this problem can occur in the kernel |
| on any arch but it's still good to fix it because some people might copy |
| the XZ code to their own projects from Linux instead of the upstream |
| XZ Embedded repository. |
| |
| This change may increase the code size by a few bytes. An alternative |
| would have been to use an unsigned int instead of enum xz_check but |
| using an enumeration looks cleaner. |
| |
| Link: https://lore.kernel.org/r/20211010213145.17462-3-xiang@kernel.org |
| Signed-off-by: Lasse Collin <lasse.collin@tukaani.org> |
| Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com> |
| Signed-off-by: Sasha Levin <sashal@kernel.org> |
| --- |
| lib/xz/xz_dec_stream.c | 6 +++--- |
| 1 file changed, 3 insertions(+), 3 deletions(-) |
| |
| diff --git a/lib/xz/xz_dec_stream.c b/lib/xz/xz_dec_stream.c |
| index bd1d182419d7e..0b161f90d8d80 100644 |
| --- a/lib/xz/xz_dec_stream.c |
| +++ b/lib/xz/xz_dec_stream.c |
| @@ -402,12 +402,12 @@ static enum xz_ret dec_stream_header(struct xz_dec *s) |
| * we will accept other check types too, but then the check won't |
| * be verified and a warning (XZ_UNSUPPORTED_CHECK) will be given. |
| */ |
| + if (s->temp.buf[HEADER_MAGIC_SIZE + 1] > XZ_CHECK_MAX) |
| + return XZ_OPTIONS_ERROR; |
| + |
| s->check_type = s->temp.buf[HEADER_MAGIC_SIZE + 1]; |
| |
| #ifdef XZ_DEC_ANY_CHECK |
| - if (s->check_type > XZ_CHECK_MAX) |
| - return XZ_OPTIONS_ERROR; |
| - |
| if (s->check_type > XZ_CHECK_CRC32) |
| return XZ_UNSUPPORTED_CHECK; |
| #else |
| -- |
| 2.33.0 |
| |