[Bug 10871] Heap overflow in decompress_unlzma

[bugzilla at busybox.net]

https://bugs.busybox.net/show_bug.cgi?id=10871

--- Comment #14 from Andrej Valek <andrej.valek at siemens.com> ---
Created attachment 7591
  --> https://bugs.busybox.net/attachment.cgi?id=7591&action=edit
fix_10871

Regarding my previous comment #12, I have found the reproducer for it and many
others.

First, your fix in #8 is not so good. There is way to access out of buffer even
if the pos > 0. (Founded 23 reproducer files.) Right fix should be:
464:

do {
        uint32_t pos = buffer_pos - rep0;
        if ((int32_t)pos < 0)
                pos += header.dict_size;

        /* bug 10436 has an example file where this triggers: */
        //if ((int32_t)pos < 0)
        //      goto bad;
        /* more stringent test (see unzip_bad_lzma_1.zip): */
        if (pos >= buffer_size)
                goto bad;

        previous_byte = buffer[pos];

Now back into my report. It's necessary to do the same fix for my mentioned
lines. (Reproducer attachment 7586)

I have added fixing patch (see attachment).

-- 
You are receiving this mail because:
You are on the CC list for the bug.