From d8db706acb8316f9861abd432cfbe001dd6d0c5c Mon Sep 17 00:00:00 2001 From: Lasse Collin Date: Mon, 28 May 2012 20:42:11 +0300 Subject: liblzma: Fix possibility of incorrect LZMA_BUF_ERROR. lzma_code() could incorrectly return LZMA_BUF_ERROR if all of the following was true: - The caller knows how many bytes of output to expect and only provides that much output space. - When the last output bytes are decoded, the caller-provided input buffer ends right before the LZMA2 end of payload marker. So LZMA2 won't provide more output anymore, but it won't know it yet and thus won't return LZMA_STREAM_END yet. - A BCJ filter is in use and it hasn't left any unfiltered bytes in the temp buffer. This can happen with any BCJ filter, but in practice it's more likely with filters other than the x86 BCJ. Another situation where the bug can be triggered happens if the uncompressed size is zero bytes and no output space is provided. In this case the decompression can fail even if the whole input file is given to lzma_code(). A similar bug was fixed in XZ Embedded on 2011-09-19. --- src/liblzma/simple/simple_coder.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'src') diff --git a/src/liblzma/simple/simple_coder.c b/src/liblzma/simple/simple_coder.c index 9e7bc289..a02b039a 100644 --- a/src/liblzma/simple/simple_coder.c +++ b/src/liblzma/simple/simple_coder.c @@ -107,7 +107,7 @@ simple_code(lzma_coder *coder, lzma_allocator *allocator, // filtered if the buffer sizes used by the application are reasonable. const size_t out_avail = out_size - *out_pos; const size_t buf_avail = coder->size - coder->pos; - if (out_avail > buf_avail) { + if (out_avail > buf_avail || buf_avail == 0) { // Store the old position so that we know from which byte // to start filtering. const size_t out_start = *out_pos; -- cgit v1.2.3