aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorColin Percival <cperciva@FreeBSD.org>2010-09-20 14:58:08 +0000
committerColin Percival <cperciva@FreeBSD.org>2010-09-20 14:58:08 +0000
commit3a68eb81a01613c9a6552bea8ddf211b474be68f (patch)
tree80b361217d0a4384a5e404ca36a29ea95124eb03
parente811d1f0f629245d33b338438789e857d01a47b1 (diff)
downloadsrc-3a68eb81a01613c9a6552bea8ddf211b474be68f.tar.gz
src-3a68eb81a01613c9a6552bea8ddf211b474be68f.zip
Fix an integer overflow in RLE length parsing when decompressing
corrupt bzip2 data. Approved by: so (cperciva) Security: FreeBSD-SA-10:08.bzip2
Notes
Notes: svn path=/releng/8.0/; revision=212901
-rw-r--r--UPDATING4
-rw-r--r--contrib/bzip2/decompress.c7
-rw-r--r--sys/conf/newvers.sh2
3 files changed, 12 insertions, 1 deletions
diff --git a/UPDATING b/UPDATING
index 262aab2cba6c..8f1ff6f85e57 100644
--- a/UPDATING
+++ b/UPDATING
@@ -15,6 +15,10 @@ NOTE TO PEOPLE WHO THINK THAT FreeBSD 8.x IS SLOW ON IA64 OR SUN4V:
debugging tools present in HEAD were left in place because
sun4v support still needs work to become production ready.
+20100920: p5 FreeBSD-SA-10:08.bzip2
+ Fix an integer overflow in RLE length parsing when decompressing
+ corrupt bzip2 data.
+
20100713: p4 FreeBSD-SA-10:07.mbuf
Correctly copy the M_RDONLY flag when duplicating a reference
to an mbuf external buffer.
diff --git a/contrib/bzip2/decompress.c b/contrib/bzip2/decompress.c
index bba5e0fa36dc..af1d4d09afb9 100644
--- a/contrib/bzip2/decompress.c
+++ b/contrib/bzip2/decompress.c
@@ -381,6 +381,13 @@ Int32 BZ2_decompress ( DState* s )
es = -1;
N = 1;
do {
+ /* Check that N doesn't get too big, so that es doesn't
+ go negative. The maximum value that can be
+ RUNA/RUNB encoded is equal to the block size (post
+ the initial RLE), viz, 900k, so bounding N at 2
+ million should guard against overflow without
+ rejecting any legitimate inputs. */
+ if (N >= 2*1024*1024) RETURN(BZ_DATA_ERROR);
if (nextSym == BZ_RUNA) es = es + (0+1) * N; else
if (nextSym == BZ_RUNB) es = es + (1+1) * N;
N = N * 2;
diff --git a/sys/conf/newvers.sh b/sys/conf/newvers.sh
index 8bdb7593fe1a..ec0cc9fa8188 100644
--- a/sys/conf/newvers.sh
+++ b/sys/conf/newvers.sh
@@ -32,7 +32,7 @@
TYPE="FreeBSD"
REVISION="8.0"
-BRANCH="RELEASE-p4"
+BRANCH="RELEASE-p5"
if [ "X${BRANCH_OVERRIDE}" != "X" ]; then
BRANCH=${BRANCH_OVERRIDE}
fi