Re: [Xen-devel] [PATCH v3 2/2] libxc: add LZ4 decompression support

["Jan Beulich" <JBeulich@xxxxxxxx>]

>>> On 04.10.13 at 13:16, Ian Campbell <Ian.Campbell@xxxxxxxxxx> wrote:
> On Mon, 2013-09-30 at 12:45 +0100, Jan Beulich wrote:
> 
>> +            chunksize = get_unaligned_le32(inp);
>> +            if (chunksize == ARCHIVE_MAGICNUMBER) {
>> +                    inp += 4;
>> +                    size -= 4;
>> +                    continue;
>> +            }
>> +            inp += 4;
>> +            size -= 4;
> 
> I think you want a chunksize < size check here, in case a malicious file
> tries to run off the end.
> 
> The rest looks good, so with e.g. this inserted:
>               if (chunksize < size) {

Did you perhaps mean the opposite

                if (chunksize > size) {

Jan

>                       msg = "insufficient input data";
>                       goto exit_2;
>               }
> 
> Acked-by: Ian Campbell <ian.campbell@xxxxxxxxxx>




_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxx
http://lists.xen.org/xen-devel