diff options
| author | joerg <joerg@NetBSD.org> | 2011-08-16 13:55:01 +0000 |
|---|---|---|
| committer | joerg <joerg@NetBSD.org> | 2011-08-16 13:55:01 +0000 |
| commit | 0537e598eba537816c6486bde3d57504b0032051 (patch) | |
| tree | a246b5fa02b41e5e75dafd2b87f1c0a36500280e /usr.bin/compress | |
| parent | 0b9467010b26738c504fba3b1244c10ea9055ff9 (diff) | |
Do proper input validation without penalizing performance.
Diffstat (limited to 'usr.bin/compress')
| -rw-r--r-- | usr.bin/compress/zopen.c | 40 |
1 files changed, 20 insertions, 20 deletions
diff --git a/usr.bin/compress/zopen.c b/usr.bin/compress/zopen.c index 68d41dc3c2a..0d3f178d164 100644 --- a/usr.bin/compress/zopen.c +++ b/usr.bin/compress/zopen.c @@ -1,4 +1,4 @@ -/* $NetBSD: zopen.c,v 1.14 2011/08/16 03:24:47 christos Exp $ */ +/* $NetBSD: zopen.c,v 1.15 2011/08/16 13:55:01 joerg Exp $ */ /*- * Copyright (c) 1985, 1986, 1992, 1993 @@ -37,7 +37,7 @@ #if 0 static char sccsid[] = "@(#)zopen.c 8.1 (Berkeley) 6/27/93"; #else -static char rcsid[] = "$NetBSD: zopen.c,v 1.14 2011/08/16 03:24:47 christos Exp $"; +static char rcsid[] = "$NetBSD: zopen.c,v 1.15 2011/08/16 13:55:01 joerg Exp $"; #endif #endif /* LIBC_SCCS and not lint */ @@ -486,7 +486,7 @@ zread(void *cookie, char *rbp, int num) block_compress = maxbits & BLOCK_MASK; maxbits &= BIT_MASK; maxmaxcode = 1L << maxbits; - if (maxbits > BITS) { + if (maxbits > BITS || maxbits < 12) { errno = EFTYPE; return (-1); } @@ -497,14 +497,7 @@ zread(void *cookie, char *rbp, int num) tab_suffixof(code) = (char_type) code; } free_ent = block_compress ? FIRST : 256; - - finchar = oldcode = getcode(zs); - if (oldcode == -1) /* EOF already? */ - return (0); /* Get out of here */ - - /* First code must be 8 bits = char. */ - *bp++ = (u_char)finchar; - count--; + oldcode = -1; stackp = de_stack; while ((code = getcode(zs)) > -1) { @@ -513,24 +506,31 @@ zread(void *cookie, char *rbp, int num) for (code = 255; code >= 0; code--) tab_prefixof(code) = 0; clear_flg = 1; - free_ent = FIRST - 1; - if ((code = getcode(zs)) == -1) /* O, untimely death! */ - break; + free_ent = FIRST; + oldcode = -1; + continue; } incode = code; - /* Special case FOR kWkWk string. */ + /* Special case for kWkWk string. */ if (code >= free_ent) { + if (code > free_ent || oldcode == -1) { + /* Bad stream. */ + errno = EINVAL; + return (-1); + } *stackp++ = finchar; code = oldcode; } + /* + * The above condition ensures that code < free_ent. + * The construction of tab_prefixof in turn guarantees that + * each iteration decreases code and therefore stack usage is + * bound by 1 << BITS - 256. + */ /* Generate output characters in reverse order. */ while (code >= 256) { - if (stackp - de_stack >= HSIZE - 1) { - errno = EOVERFLOW; - return -1; - } *stackp++ = tab_suffixof(code); code = tab_prefixof(code); } @@ -544,7 +544,7 @@ middle: do { } while (stackp > de_stack); /* Generate the new entry. */ - if ((code = free_ent) < maxmaxcode) { + if ((code = free_ent) < maxmaxcode && oldcode != -1) { tab_prefixof(code) = (u_short) oldcode; tab_suffixof(code) = finchar; free_ent = code + 1; |
