lzo: properly check for overruns
authorGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Thu, 3 Jul 2014 14:39:30 +0000 (16:39 +0200)
committerJan Beulich <jbeulich@suse.com>
Thu, 3 Jul 2014 14:39:30 +0000 (16:39 +0200)
commit504f70b624063bbb32d43cdfe6e8409eaac1fa8e
tree34317cab610e5da89e64c1dce36fbcfc984e69a1
parent447f613c54041e78f04ecbbfea42120ab6c76974
lzo: properly check for overruns

The lzo decompressor can, if given some really crazy data, possibly
overrun some variable types.  Modify the checking logic to properly
detect overruns before they happen.

Reported-by: "Don A. Bailey" <donb@securitymouse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Original Linux commit: 206a81c18401c0cde6e579164f752c4b147324ce.

This is CVE-2014-4607 (but not a security issue in Xen, since the code
is only used for loading the Dom0 kernel and _inside_ an eventual DomU
for loading its kernel).

Signed-off-by: Jan Beulich <jbeulich@suse.com>
Acked-by: Ian Campbell <ian.campbell@citrix.com>
xen/common/lzo.c