zfs-patches/0023-Fix-zle_decompress-out-of-bound-access.patch

   1 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
   2 From: Chunwei Chen <david.chen@nutanix.com>
   3 Date: Thu, 1 Feb 2018 15:41:05 -0800
   4 Subject: [PATCH] Fix zle_decompress out of bound access
   5 MIME-Version: 1.0
   6 Content-Type: text/plain; charset=UTF-8
   7 Content-Transfer-Encoding: 8bit
   8
   9 Reviewed-by: Brian Behlendorf <behlendorf1@llnl.gov>
  10 Reviewed-by: loli10K <ezomori.nozomu@gmail.com>
  11 Signed-off-by: Chunwei Chen <david.chen@nutanix.com>
  12 Closes #7099
  13 (cherry picked from commit 5e566c57726226ceeca09b1eb19cb1c373622763)
  14 Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
  15 ---
  16  module/zfs/zle.c | 4 ++++
  17  1 file changed, 4 insertions(+)
  18
  19 diff --git a/module/zfs/zle.c b/module/zfs/zle.c
  20 index 13c5673fb..613607faa 100644
  21 --- a/module/zfs/zle.c
  22 +++ b/module/zfs/zle.c
  23 @@ -74,10 +74,14 @@ zle_decompress(void *s_start, void *d_start, size_t s_len, size_t d_len, int n)
  24         while (src < s_end && dst < d_end) {
  25                 int len = 1 + *src++;
  26                 if (len <= n) {
  27 +                       if (src + len > s_end || dst + len > d_end)
  28 +                               return (-1);
  29                         while (len-- != 0)
  30                                 *dst++ = *src++;
  31                 } else {
  32                         len -= n;
  33 +                       if (dst + len > d_end)
  34 +                               return (-1);
  35                         while (len-- != 0)
  36                                 *dst++ = 0;
  37                 }
  38 --
  39 2.14.2
  40