summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorJinWang An <jinwang.an@samsung.com>2021-02-16 11:04:04 +0900
committerJinWang An <jinwang.an@samsung.com>2021-02-16 12:53:29 +0900
commit90abb7b35916f11d6ef09cd2ba3a1a15c84d2fd8 (patch)
treeb6acd05bd66d15847fce5b04f868725e12752ee5
parenta26c0b2357111eed25cf264967cbf2bc1c306650 (diff)
downloadcmake-submit/tizen_base/20210216.053949.tar.gz
cmake-submit/tizen_base/20210216.053949.tar.bz2
cmake-submit/tizen_base/20210216.053949.zip
[CVE-2016-9841] Use post-increment only in inffast.c.submit/tizen_base/20210216.053949
An old inffast.c optimization turns out to not be optimal anymore with modern compilers, and furthermore was not compliant with the C standard, for which decrementing a pointer before its allocated memory is undefined. Per the recommendation of a security audit of the zlib code by Trail of Bits and TrustInSoft, in support of the Mozilla Foundation, this "optimization" was removed, in order to avoid the possibility of undefined behavior. Change-Id: Ic12de92b938e9e3d8856e6ff0cf50d55cb9488ef Signed-off-by: JinWang An <jinwang.an@samsung.com>
-rw-r--r--Utilities/cmzlib/inffast.c75
1 files changed, 28 insertions, 47 deletions
diff --git a/Utilities/cmzlib/inffast.c b/Utilities/cmzlib/inffast.c
index bbee92ed1..0aa788379 100644
--- a/Utilities/cmzlib/inffast.c
+++ b/Utilities/cmzlib/inffast.c
@@ -10,25 +10,6 @@
#ifndef ASMINF
-/* Allow machine dependent optimization for post-increment or pre-increment.
- Based on testing to date,
- Pre-increment preferred for:
- - PowerPC G3 (Adler)
- - MIPS R5000 (Randers-Pehrson)
- Post-increment preferred for:
- - none
- No measurable difference:
- - Pentium III (Anderson)
- - M68060 (Nikl)
- */
-#ifdef POSTINC
-# define OFF 0
-# define PUP(a) *(a)++
-#else
-# define OFF 1
-# define PUP(a) *++(a)
-#endif
-
/*
Decode literal, length, and distance codes and write out the resulting
literal and match bytes until either not enough input or output is
@@ -96,9 +77,9 @@ unsigned start; /* inflate()'s starting value for strm->avail_out */
/* copy state to local variables */
state = (struct inflate_state FAR *)strm->state;
- in = strm->next_in - OFF;
+ in = strm->next_in;
last = in + (strm->avail_in - 5);
- out = strm->next_out - OFF;
+ out = strm->next_out;
beg = out - (start - strm->avail_out);
end = out + (strm->avail_out - 257);
#ifdef INFLATE_STRICT
@@ -119,9 +100,9 @@ unsigned start; /* inflate()'s starting value for strm->avail_out */
input data or output space */
do {
if (bits < 15) {
- hold += (unsigned long)(PUP(in)) << bits;
+ hold += (unsigned long)(*(in)++) << bits;
bits += 8;
- hold += (unsigned long)(PUP(in)) << bits;
+ hold += (unsigned long)(*(in)++) << bits;
bits += 8;
}
this = lcode[hold & lmask];
@@ -134,14 +115,14 @@ unsigned start; /* inflate()'s starting value for strm->avail_out */
Tracevv((stderr, this.val >= 0x20 && this.val < 0x7f ?
"inflate: literal '%c'\n" :
"inflate: literal 0x%02x\n", this.val));
- PUP(out) = (unsigned char)(this.val);
+ *(out)++ = (unsigned char)(this.val);
}
else if (op & 16) { /* length base */
len = (unsigned)(this.val);
op &= 15; /* number of extra bits */
if (op) {
if (bits < op) {
- hold += (unsigned long)(PUP(in)) << bits;
+ hold += (unsigned long)(*(in)++) << bits;
bits += 8;
}
len += (unsigned)hold & ((1U << op) - 1);
@@ -150,9 +131,9 @@ unsigned start; /* inflate()'s starting value for strm->avail_out */
}
Tracevv((stderr, "inflate: length %u\n", len));
if (bits < 15) {
- hold += (unsigned long)(PUP(in)) << bits;
+ hold += (unsigned long)(*(in)++) << bits;
bits += 8;
- hold += (unsigned long)(PUP(in)) << bits;
+ hold += (unsigned long)(*(in)++) << bits;
bits += 8;
}
this = dcode[hold & dmask];
@@ -165,10 +146,10 @@ unsigned start; /* inflate()'s starting value for strm->avail_out */
dist = (unsigned)(this.val);
op &= 15; /* number of extra bits */
if (bits < op) {
- hold += (unsigned long)(PUP(in)) << bits;
+ hold += (unsigned long)(*(in)++) << bits;
bits += 8;
if (bits < op) {
- hold += (unsigned long)(PUP(in)) << bits;
+ hold += (unsigned long)(*(in)++) << bits;
bits += 8;
}
}
@@ -191,13 +172,13 @@ unsigned start; /* inflate()'s starting value for strm->avail_out */
state->mode = BAD;
break;
}
- from = window - OFF;
+ from = window;
if (write == 0) { /* very common case */
from += wsize - op;
if (op < len) { /* some from window */
len -= op;
do {
- PUP(out) = PUP(from);
+ *(out)++ = *(from)++;
} while (--op);
from = out - dist; /* rest from output */
}
@@ -208,14 +189,14 @@ unsigned start; /* inflate()'s starting value for strm->avail_out */
if (op < len) { /* some from end of window */
len -= op;
do {
- PUP(out) = PUP(from);
+ *(out)++ = *(from)++;
} while (--op);
- from = window - OFF;
+ from = window;
if (write < len) { /* some from start of window */
op = write;
len -= op;
do {
- PUP(out) = PUP(from);
+ *(out)++ = *(from)++;
} while (--op);
from = out - dist; /* rest from output */
}
@@ -226,35 +207,35 @@ unsigned start; /* inflate()'s starting value for strm->avail_out */
if (op < len) { /* some from window */
len -= op;
do {
- PUP(out) = PUP(from);
+ *(out)++ = *(from)++;
} while (--op);
from = out - dist; /* rest from output */
}
}
while (len > 2) {
- PUP(out) = PUP(from);
- PUP(out) = PUP(from);
- PUP(out) = PUP(from);
+ *(out)++ = *(from)++;
+ *(out)++ = *(from)++;
+ *(out)++ = *(from)++;
len -= 3;
}
if (len) {
- PUP(out) = PUP(from);
+ *(out)++ = *(from)++;
if (len > 1)
- PUP(out) = PUP(from);
+ *(out)++ = *(from)++;
}
}
else {
from = out - dist; /* copy direct from output */
do { /* minimum length is three */
- PUP(out) = PUP(from);
- PUP(out) = PUP(from);
- PUP(out) = PUP(from);
+ *(out)++ = *(from)++;
+ *(out)++ = *(from)++;
+ *(out)++ = *(from)++;
len -= 3;
} while (len > 2);
if (len) {
- PUP(out) = PUP(from);
+ *(out)++ = *(from)++;
if (len > 1)
- PUP(out) = PUP(from);
+ *(out)++ = *(from)++;
}
}
}
@@ -291,8 +272,8 @@ unsigned start; /* inflate()'s starting value for strm->avail_out */
hold &= (1U << bits) - 1;
/* update state and return */
- strm->next_in = in + OFF;
- strm->next_out = out + OFF;
+ strm->next_in = in;
+ strm->next_out = out;
strm->avail_in = (unsigned)(in < last ? 5 + (last - in) : 5 - (in - last));
strm->avail_out = (unsigned)(out < end ?
257 + (end - out) : 257 - (out - end));