From f4b38c6cd882bbc88c6a39a4f5d0fb81818fe107 Mon Sep 17 00:00:00 2001 From: Lasse Collin Date: Fri, 11 Nov 2011 14:32:57 +0100 Subject: [PATCH] Decompressors: check for read errors in unlzma.c From: Lasse Collin Return value of rc->fill() is checked in rc_read() and error() is called when needed, but then the code continues as if nothing had happened. rc_read() is a void function and it's on the top of performance critical call stacks, so propagating the error code via return values doesn't sound like the best fix. It seems better to check rc->buffer_size (which holds the return value of rc->fill()) in the main loop. It does nothing bad that the code runs a little with unknown data after a failed rc->fill(). This fixes an infinite loop in initramfs decompression if the LZMA-compressed initramfs image is corrupt. Signed-off-by: Lasse Collin Signed-off-by: Jan Beulich Acked-by: Keir Fraser Committed-by: Jan Beulich --- xen/common/unlzma.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/xen/common/unlzma.c b/xen/common/unlzma.c index eb3fbba826..781982b524 100644 --- a/xen/common/unlzma.c +++ b/xen/common/unlzma.c @@ -625,6 +625,8 @@ STATIC int INIT unlzma(unsigned char *buf, unsigned int in_len, if (cst.rep0 == 0) break; } + if (rc.buffer_size <= 0) + goto exit_3; } if (posp) @@ -632,6 +634,7 @@ STATIC int INIT unlzma(unsigned char *buf, unsigned int in_len, if (wr.flush) wr.flush(wr.buffer, wr.buffer_pos); ret = 0; +exit_3: large_free(p); exit_2: if (!output) -- 2.30.2