aboutsummaryrefslogtreecommitdiff
path: root/src/liblzma/lz/lz_decoder.c
diff options
context:
space:
mode:
authorLasse Collin <lasse.collin@tukaani.org>2019-05-13 20:05:17 +0300
committerLasse Collin <lasse.collin@tukaani.org>2019-05-13 20:05:17 +0300
commit2a22de439ec63da1927b640eda309296a1e8dce5 (patch)
tree045c0bace711dabf560ceda0223dafe286d7c96d /src/liblzma/lz/lz_decoder.c
parentUpdate THANKS. (diff)
downloadxz-2a22de439ec63da1927b640eda309296a1e8dce5.tar.xz
liblzma: Avoid memcpy(NULL, foo, 0) because it is undefined behavior.
I should have always known this but I didn't. Here is an example as a reminder to myself: int mycopy(void *dest, void *src, size_t n) { memcpy(dest, src, n); return dest == NULL; } In the example, a compiler may assume that dest != NULL because passing NULL to memcpy() would be undefined behavior. Testing with GCC 8.2.1, mycopy(NULL, NULL, 0) returns 1 with -O0 and -O1. With -O2 the return value is 0 because the compiler infers that dest cannot be NULL because it was already used with memcpy() and thus the test for NULL gets optimized out. In liblzma, if a null-pointer was passed to memcpy(), there were no checks for NULL *after* the memcpy() call, so I cautiously suspect that it shouldn't have caused bad behavior in practice, but it's hard to be sure, and the problematic cases had to be fixed anyway. Thanks to Jeffrey Walton.
Diffstat (limited to '')
-rw-r--r--src/liblzma/lz/lz_decoder.c12
1 files changed, 9 insertions, 3 deletions
diff --git a/src/liblzma/lz/lz_decoder.c b/src/liblzma/lz/lz_decoder.c
index bb21d0d0..6c9024e2 100644
--- a/src/liblzma/lz/lz_decoder.c
+++ b/src/liblzma/lz/lz_decoder.c
@@ -91,11 +91,17 @@ decode_buffer(lzma_coder *coder,
in, in_pos, in_size);
// Copy the decoded data from the dictionary to the out[]
- // buffer.
+ // buffer. Do it conditionally because out can be NULL
+ // (in which case copy_size is always 0). Calling memcpy()
+ // with a null-pointer is undefined even if the third
+ // argument is 0.
const size_t copy_size = coder->dict.pos - dict_start;
assert(copy_size <= out_size - *out_pos);
- memcpy(out + *out_pos, coder->dict.buf + dict_start,
- copy_size);
+
+ if (copy_size > 0)
+ memcpy(out + *out_pos, coder->dict.buf + dict_start,
+ copy_size);
+
*out_pos += copy_size;
// Reset the dictionary if so requested by coder->lz.code().