linux-toradex.git/lib/decompress_unlzma.c, branch v3.12-rc2

treewide: Fix comment and string typo 'bufer'

2011-12-06T08:53:40+00:00

Signed-off-by: Paul Bolle 
Signed-off-by: Jiri Kosina

Decompressors: validate match distance in decompress_unlzma.c

2011-01-13T16:03:24+00:00

Validate the newly decoded distance (rep0) in process_bit1().  This is to
detect corrupt LZMA data quickly.  The old code can run for long time
producing garbage until it hits the end of the input.

Signed-off-by: Lasse Collin 
Cc: "H. Peter Anvin" 
Cc: Alain Knaff 
Cc: Albin Tonnerre 
Cc: Phillip Lougher 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

Decompressors: check for write errors in decompress_unlzma.c

2011-01-13T16:03:24+00:00

The return value of wr->flush() is not checked in write_byte().  This
means that the decompressor won't stop even if the caller doesn't want
more data.  This can happen e.g.  with corrupt LZMA-compressed initramfs.
Returning the error quickly allows the user to see the error message
quicker.

There is a similar missing check for wr.flush() near the end of unlzma().

Signed-off-by: Lasse Collin 
Cc: "H. Peter Anvin" 
Cc: Alain Knaff 
Cc: Albin Tonnerre 
Cc: Phillip Lougher 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

Decompressors: check for read errors in decompress_unlzma.c

2011-01-13T16:03:24+00:00

Return value of rc->fill() is checked in rc_read() and error() is called
when needed, but then the code continues as if nothing had happened.

rc_read() is a void function and it's on the top of performance critical
call stacks, so propagating the error code via return values doesn't sound
like the best fix.  It seems better to check rc->buffer_size (which holds
the return value of rc->fill()) in the main loop.  It does nothing bad
that the code runs a little with unknown data after a failed rc->fill().

This fixes an infinite loop in initramfs decompression if the
LZMA-compressed initramfs image is corrupt.

Signed-off-by: Lasse Collin 
Cc: "H. Peter Anvin" 
Cc: Alain Knaff 
Cc: Albin Tonnerre 
Cc: Phillip Lougher 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

Decompressors: fix header validation in decompress_unlzma.c

2011-01-13T16:03:24+00:00

Validation of header.pos calls error() but doesn't make the function
return to indicate an error to the caller.  Instead the decoding is
attempted with invalid header.pos.  This fixes it.

Signed-off-by: Lasse Collin 
Cc: "H. Peter Anvin" 
Cc: Alain Knaff 
Cc: Albin Tonnerre 
Cc: Phillip Lougher 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

Decompressors: remove unused function from lib/decompress_unlzma.c

2011-01-13T16:03:23+00:00

Signed-off-by: Lasse Collin 
Cc: "H. Peter Anvin" 
Cc: Alain Knaff 
Cc: Albin Tonnerre 
Cc: Phillip Lougher 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

Decompressors: include in

2011-01-13T16:03:23+00:00

Currently users of mm.h need to include  to use the macros
malloc() and free() provided by mm.h.  This fixes it.

Signed-off-by: Lasse Collin 
Cc: "H. Peter Anvin" 
Cc: Alain Knaff 
Cc: Albin Tonnerre 
Cc: Phillip Lougher 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

Decompressors: get rid of set_error_fn() macro

2011-01-13T16:03:23+00:00

set_error_fn() has become a useless complication after c1e7c3ae59
("bzip2/lzma/gzip: pre-boot malloc doesn't return NULL on failure") fixed
the use of error() in malloc().  Only decompress_unlzma.c had some use for
it and that was easy to change too.

This also gets rid of the static function pointer "error", which
should have been marked as __initdata.

Signed-off-by: Lasse Collin 
Cc: "H. Peter Anvin" 
Cc: Alain Knaff 
Cc: Albin Tonnerre 
Cc: Phillip Lougher 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

Decompressors: add missing INIT (i.e. __init)

2011-01-13T16:03:23+00:00

Signed-off-by: Lasse Collin 
Cc: "H. Peter Anvin" 
Cc: Alain Knaff 
Cc: Albin Tonnerre 
Cc: Phillip Lougher 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

lzma/gzip: fix potential oops when input data is truncated

2009-09-24T14:21:05+00:00

If the lzma/gzip decompressors are called with insufficient input data
(len > 0 & fill = NULL), they will attempt to call the fill function to
obtain more data, leading to a kernel oops.

Signed-off-by: Phillip Lougher 
Cc: "H. Peter Anvin" 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds