| Andrew Geissler | d159c7f | 2021-09-02 21:05:58 -0500 | [diff] [blame] | 1 | From 8301a21773ef61656225e264f4f06ae14462bca7 Mon Sep 17 00:00:00 2001 |
| 2 | From: Jasper Lievisse Adriaanse <j@jasper.la> |
| 3 | Date: Fri, 26 Feb 2021 15:21:20 +0100 |
| 4 | Subject: [PATCH] Fix potential memory corruption with negative memmove() size |
| 5 | |
| 6 | Upstream-Status: Backport |
| 7 | https://github.com/lz4/lz4/commit/8301a21773ef61656225e264f4f06ae14462bca7#diff-7055e9cf14c488aea9837aaf9f528b58ee3c22988d7d0d81d172ec62d94a88a7 |
| 8 | CVE: CVE-2021-3520 |
| 9 | Signed-off-by: Armin Kuster <akuster@mvista.com> |
| 10 | |
| 11 | --- |
| 12 | lib/lz4.c | 2 +- |
| 13 | 1 file changed, 1 insertion(+), 1 deletion(-) |
| 14 | |
| 15 | Index: git/lib/lz4.c |
| 16 | =================================================================== |
| 17 | --- git.orig/lib/lz4.c |
| 18 | +++ git/lib/lz4.c |
| 19 | @@ -1665,7 +1665,7 @@ LZ4_decompress_generic( |
| 20 | const size_t dictSize /* note : = 0 if noDict */ |
| 21 | ) |
| 22 | { |
| 23 | - if (src == NULL) { return -1; } |
| 24 | + if ((src == NULL) || (outputSize < 0)) { return -1; } |
| 25 | |
| 26 | { const BYTE* ip = (const BYTE*) src; |
| 27 | const BYTE* const iend = ip + srcSize; |