DigiGoon/android_kernel_xiaomi_sm8350
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

jffs2: Prevent rtime decompress memory corruption

Browse source 
commit fe051552f5078fa02d593847529a3884305a6ffe upstream.

The rtime decompression routine does not fully check bounds during the
entirety of the decompression pass and can corrupt memory outside the
decompression buffer if the compressed data is corrupted. This adds the
required check to prevent this failure mode.

Cc: stable@vger.kernel.org
Signed-off-by: Kinsey Moore <kinsey.moore@oarcorp.com>
Signed-off-by: Richard Weinberger <richard@nod.at>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Kinsey Moore 2024-07-23 15:58:05 -05:00 • committed by Greg Kroah-Hartman
parent 4098c94097
commit 421f9e9f0f
1 changed files with 3 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
fs/jffs2/compr_rtime.c
View file

@ -95,6 +95,9 @@ static int jffs2_rtime_decompress(unsigned char *data_in,
positions[value]=outpos; positions[value]=outpos;
if (repeat) { if (repeat) {
if ((outpos + repeat) >= destlen) {
return 1;
}
if (backoffs + repeat >= outpos) { if (backoffs + repeat >= outpos) {
while(repeat) { while(repeat) {
cpage_out[outpos++] = cpage_out[backoffs++]; cpage_out[outpos++] = cpage_out[backoffs++];