这是indexloc提供的服务，不要输入任何密码
Skip to content

[CHUNKCOPY_SAFE] Fix off-by-one error #982

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 3 commits into from
Jun 11, 2021
Merged

[CHUNKCOPY_SAFE] Fix off-by-one error #982

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
d9f4ddd
[CHUNKCOPY_SAFE] Fix off-by-one error
mtl1979 Jun 9, 2021
0373f6f
[inflate_fast] Always use safe versions of chunkcopy and chunkmemset …
nmoinvaz Jun 9, 2021
bd27bef
[CHUNKMEMSET_SAFE] Precalculate "from".
mtl1979 Jun 10, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 5 additions & 3 deletions chunkset_tpl.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,7 +37,8 @@ Z_INTERNAL uint8_t* CHUNKCOPY(uint8_t *out, uint8_t const *from, unsigned len) {

/* Behave like chunkcopy, but avoid writing beyond of legal output. */
Z_INTERNAL uint8_t* CHUNKCOPY_SAFE(uint8_t *out, uint8_t const *from, unsigned len, uint8_t *safe) {
if ((safe - out) < (ptrdiff_t)sizeof(chunk_t)) {
len = MIN(len, safe - out + 1);
if (len < sizeof(chunk_t)) {
int32_t use_chunk16 = sizeof(chunk_t) > 16 && (len & 16);
if (use_chunk16) {
memcpy(out, from, 16);
Expand Down Expand Up @@ -160,10 +161,11 @@ Z_INTERNAL uint8_t* CHUNKMEMSET(uint8_t *out, unsigned dist, unsigned len) {
}

Z_INTERNAL uint8_t* CHUNKMEMSET_SAFE(uint8_t *out, unsigned dist, unsigned len, unsigned left) {
len = MIN(len, left);
if (left < (unsigned)(3 * sizeof(chunk_t))) {
uint8_t *from = out - dist;
while (len > 0) {
*out = *(out - dist);
out++;
*out++ = *from++;
--len;
}
return out;
Expand Down
10 changes: 3 additions & 7 deletions inffast.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -260,15 +260,11 @@ void Z_INTERNAL zng_inflate_fast(PREFIX3(stream) *strm, unsigned long start) {
out = functable.chunkcopy_safe(out, from, len, safe);
}
} else {
/* Whole reference is in range of current output. No range checks are
necessary because we start with room for at least 258 bytes of output,
so unroll and roundoff operations can write beyond `out+len` so long
as they stay within 258 bytes of `out`.
*/
/* Whole reference is in range of current output. */
if (dist >= len || dist >= state->chunksize)
out = functable.chunkcopy(out, out - dist, len);
out = functable.chunkcopy_safe(out, out - dist, len, safe);
else
out = functable.chunkmemset(out, dist, len);
out = functable.chunkmemset_safe(out, dist, len, safe - out + 1);
}
} else if ((op & 64) == 0) { /* 2nd level distance code */
here = dcode + here->val + BITS(op);
Expand Down