Re: [Xen-devel] [PATCH v3 2/2] libxc: add LZ4 decompression support

[Ian Campbell <Ian.Campbell@xxxxxxxxxx>]

On Mon, 2013-09-30 at 12:45 +0100, Jan Beulich wrote:

> +             chunksize = get_unaligned_le32(inp);
> +             if (chunksize == ARCHIVE_MAGICNUMBER) {
> +                     inp += 4;
> +                     size -= 4;
> +                     continue;
> +             }
> +             inp += 4;
> +             size -= 4;

I think you want a chunksize < size check here, in case a malicious file
tries to run off the end.

The rest looks good, so with e.g. this inserted:
                if (chunksize < size) {
                        msg = "insufficient input data";
                        goto exit_2;
                }

Acked-by: Ian Campbell <ian.campbell@xxxxxxxxxx>



_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxx
http://lists.xen.org/xen-devel