u-boot/lib
Stephen Warren 1934665742 gunzip: remove avail_in recalculation
Current, the following passes:
    ./u-boot -d arch/sandbox/dts/test.dtb -c 'ut_image_decomp'
but the following fails:
    ./u-boot -d arch/sandbox/dts/test.dtb -c 'ut dm; ut_image_decomp'

This is because the gunzip code reads input data beyond the end of its
input buffer. In the first case above, this data just happens to be 0,
which just happens to trigger gzip to signal the error the decompression
unit test expects. In the second case above, the "ut dm" test has written
data to the accidentally-read memory, which causes the gzip code to take a
different path and so return a different value, which triggers the test
failure.

The cause of gunzip reading past its input buffer is the re-calculation of
s.avail_in in zunzip(), since it can underflow. Not only is the formula
non-sensical (it uses the delta between two output buffer pointers to
calculate available input buffer size), it also appears to be unnecessary,
since the gunzip code already maintains this value itself. This patch
removes this re-calculation to avoid the underflow and redundant work.

The loop exit condition is also adjusted so that if inflate() has consumed
the entire input buffer, without indicating returning Z_STREAM_END (i.e.
decompression complete without error), an error is raised. There is still
opportunity to simplify the code here by splitting up the loop exit
condition into separate tests. However, this patch makes the minimum
modifications required to solve the problem at hand, in order to keep the
Acked-by: Kees Cook <keescook@chromium.org>

diff simple.

I am not entirely convinced that the loop in zunzip() is necessary at all.
It could only be useful if inflate() can return Z_BUF_ERROR (which
typically means that it needs more data in the input buffer, or more space
in the output buffer), even though Z_FINISH is set /and/ the full input is
available in the input buffer /and/ there is enough space to store the
decompressed output in the output buffer. The comment in zlib.h after the
prototype of inflate() implies this is never the case. However, I assume
there must have been some reason for introducing this loop in the first
place, as part of commit "Fix gunzip to work for any gziped uImage size".

This patch is similar to the earlier b75650d84d "gzip: correctly
bounds-check output buffer", which corrected a similar issue for
s.avail_out.

Cc: Catalin Radu <Catalin@VirtualMetrix.com>
Cc: Kees Cook <keescook@chromium.org>
Fixes: f039ada5c1 ("Fix gunzip to work for any gziped uImage size")
Signed-off-by: Stephen Warren <swarren@nvidia.com>
2016-02-09 15:41:19 -07:00
..
bzip2 bzlib: Try another way to fix an unused variable 2016-02-06 13:59:48 +01:00
dhry Add a dhrystone benchmark command 2015-07-21 17:39:19 -06:00
efi debug_uart: Adjust the declaration of debug_uart_init() 2015-10-21 07:46:50 -06:00
libfdt fdt: Correct handling of alias regions 2015-11-04 14:49:51 +01:00
lzma lzma: fix buffer bound check error further 2015-01-14 11:35:43 -05:00
lzo lzo: Update dst_len even on error 2015-01-14 11:35:44 -05:00
rsa rsa : Compile Modular Exponentiation files based on CONFIG_RSA_SOFTWARE_EXP 2015-03-05 12:04:59 -08:00
tizen Logo: TIZEN: Change booting logo size to official size. 2014-03-28 15:06:30 -04:00
zlib Use correct spelling of "U-Boot" 2016-02-06 12:00:59 +01:00
addr_map.c Add more SPDX-License-Identifier tags 2016-01-19 08:31:21 -05:00
aes.c aes: make apply_cbc_chain_data non-static 2014-04-18 16:14:17 -04:00
asm-offsets.c lib/asm-offsets - make GD_RELOCADDR, GD_RELOC_OFF & GD_START_ADDR_SP available for all architectures 2015-03-05 20:50:28 -05:00
bch.c Add more SPDX-License-Identifier tags 2016-01-19 08:31:21 -05:00
bitrev.c Add GPL-2.0+ SPDX-License-Identifier to source files 2013-07-24 09:44:38 -04:00
circbuf.c Add GPL-2.0+ SPDX-License-Identifier to source files 2013-07-24 09:44:38 -04:00
crc7.c lib: add crc7 from Linux 2011-01-18 23:38:08 +01:00
crc8.c Add crc8 routine 2014-01-08 17:20:34 -07:00
crc16.c Add eCos-2.0 SPDX-License-Identifier to source files 2013-07-24 09:45:01 -04:00
crc32.c crc32: Correct endianness of crc32 result 2013-04-19 10:24:14 -04:00
ctype.c Add GPL-2.0+ SPDX-License-Identifier to source files 2013-07-24 09:44:38 -04:00
display_options.c Drop config.h header from display_options.c 2015-11-19 20:27:50 -07:00
div64.c lib: div64: add missing include 2014-07-18 17:53:22 -04:00
errno.c Add basic errno support. 2010-09-19 19:29:47 +02:00
errno_str.c lib: errno: introduce errno_str(): returns errno related message 2014-12-11 13:18:41 -07:00
fdtdec.c fdt: introduce fdtdec_get_child_count 2016-02-06 14:43:04 +01:00
fdtdec_common.c lib, fdt: Adding fdtdec_get_uint function 2015-11-05 02:34:14 +01:00
fdtdec_test.c Add GPL-2.0+ SPDX-License-Identifier to source files 2013-07-24 09:44:38 -04:00
gunzip.c gunzip: remove avail_in recalculation 2016-02-09 15:41:19 -07:00
gzip.c Move malloc_cache_aligned() to its own header 2015-09-11 17:15:16 -04:00
hang.c Add GPL-2.0+ SPDX-License-Identifier to source files 2013-07-24 09:44:38 -04:00
hashtable.c env: import: hashtable: Free memory allocated before exiting from himport_r() 2015-09-15 15:05:13 -04:00
initcall.c efi: Display the correct initcall pre-relocation values 2015-08-05 08:42:41 -06:00
Kconfig Use correct spelling of "U-Boot" 2016-02-06 12:00:59 +01:00
ldiv.c Add LGPL-2.0+ SPDX-License-Identifier to source files 2013-07-24 09:45:01 -04:00
linux_compat.c linux_compat: handle __GFP_ZERO in kmalloc() 2015-07-22 07:30:44 -06:00
linux_string.c Make linux kernel string funcs available to tools 2012-12-13 11:46:07 -07:00
list_sort.c kbuild: force to define __UBOOT__ in all the C sources 2014-09-16 12:23:56 -04:00
lmb.c lmb: make local functions static 2014-10-25 07:02:01 -04:00
lz4.c Add support for LZ4 decompression algorithm 2015-10-11 17:12:10 -04:00
lz4_wrapper.c Fix sandbox build on Ubuntu 10.04 2015-11-18 15:28:59 -05:00
Makefile lib: split out strtoxxxx functions out of vsprintf.c 2015-12-13 17:07:30 -07:00
md5.c GCC47: Fix warning in md5.c 2012-04-29 14:14:08 +02:00
membuff.c Add a circular memory buffer implementation 2015-11-19 20:27:50 -07:00
net_utils.c net: cosmetic: Change IPaddr_t to struct in_addr 2015-04-18 11:11:32 -06:00
panic.c lib: Split panic functions out of vsprintf.c 2015-12-13 17:07:30 -07:00
physmem.c Introduce arch_phys_memset which works like memset but on physical memory 2012-12-06 14:30:40 -08:00
qsort.c Include common.h in qsort.c to fix build warning 2011-12-07 08:39:54 +01:00
rand.c Add GPL-2.0+ SPDX-License-Identifier to source files 2013-07-24 09:44:38 -04:00
rbtree.c kbuild: force to define __UBOOT__ in all the C sources 2014-09-16 12:23:56 -04:00
rc4.c Add rivest cipher 4 (rc4) implementation 2015-07-21 17:39:28 -06:00
sha1.c Add more SPDX-License-Identifier tags 2016-01-19 08:31:21 -05:00
sha256.c includes: move openssl headers to include/u-boot 2014-06-19 11:19:04 -04:00
slre.c Coding Style cleanup: remove trailing white space 2013-10-14 16:06:53 -04:00
string.c lib: string: move strlcpy() to a common place 2014-12-11 13:18:41 -07:00
strmhz.c replace DIV_ROUND with DIV_ROUND_CLOSEST 2014-11-20 11:28:25 -05:00
strto.c lib: split out strtoxxxx functions out of vsprintf.c 2015-12-13 17:07:30 -07:00
time.c dm: timer: uclass: add timer init in uclass driver to add timer device 2016-01-20 19:06:21 -07:00
tiny-printf.c tiny-printf: Always print zeroes 2016-01-20 19:06:22 -07:00
tpm.c tpm: Fix fault in case CONFIG_DM_TPM is set without any TPM 2016-01-28 21:01:22 -07:00
trace.c common: Make sure arch-specific map_sysmem() is defined 2015-04-18 11:11:09 -06:00
uuid.c uuid: add selection by string for known partition type GUID 2015-11-12 15:58:58 -05:00
vsprintf.c vsprintf.c: Always enable CONFIG_SYS_VSNPRINTF 2016-01-19 08:31:16 -05:00