mirror of
https://github.com/torvalds/linux.git
synced 2024-12-11 13:41:55 +00:00
3689456b4b
Fix potential use of uninitialised variable caused by recent
decompressor code optimisations.
In zlib_uncompress (zlib_wrapper.c) we have
int zlib_err, zlib_init = 0;
...
do {
...
if (avail == 0) {
offset = 0;
put_bh(bh[k++]);
continue;
}
...
zlib_err = zlib_inflate(stream, Z_SYNC_FLUSH);
...
} while (zlib_err == Z_OK);
If continue is executed (avail == 0) then the while condition will be
evaluated testing zlib_err, which is uninitialised first time around the
loop.
Fix this by getting rid of the 'if (avail == 0)' condition test, this
edge condition should not be being handled in the decompressor code, and
instead handle it generically in the caller code.
Similarly for xz_wrapper.c.
Incidentally, on most architectures (bar Mips and Parisc), no
uninitialised variable warning is generated by gcc, this is because the
while condition test on continue is optimised out and not performed
(when executing continue zlib_err has not been changed since entering
the loop, and logically if the while condition was true previously, then
it's still true).
Signed-off-by: Phillip Lougher <phillip@lougher.demon.co.uk>
Reported-by: Jesper Juhl <jj@chaosbits.net>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
150 lines
3.4 KiB
C
150 lines
3.4 KiB
C
/*
|
|
* Squashfs - a compressed read only filesystem for Linux
|
|
*
|
|
* Copyright (c) 2002, 2003, 2004, 2005, 2006, 2007, 2008, 2009
|
|
* Phillip Lougher <phillip@lougher.demon.co.uk>
|
|
*
|
|
* This program is free software; you can redistribute it and/or
|
|
* modify it under the terms of the GNU General Public License
|
|
* as published by the Free Software Foundation; either version 2,
|
|
* or (at your option) any later version.
|
|
*
|
|
* This program is distributed in the hope that it will be useful,
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
* GNU General Public License for more details.
|
|
*
|
|
* You should have received a copy of the GNU General Public License
|
|
* along with this program; if not, write to the Free Software
|
|
* Foundation, 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
|
|
*
|
|
* zlib_wrapper.c
|
|
*/
|
|
|
|
|
|
#include <linux/mutex.h>
|
|
#include <linux/buffer_head.h>
|
|
#include <linux/slab.h>
|
|
#include <linux/zlib.h>
|
|
|
|
#include "squashfs_fs.h"
|
|
#include "squashfs_fs_sb.h"
|
|
#include "squashfs.h"
|
|
#include "decompressor.h"
|
|
|
|
static void *zlib_init(struct squashfs_sb_info *dummy)
|
|
{
|
|
z_stream *stream = kmalloc(sizeof(z_stream), GFP_KERNEL);
|
|
if (stream == NULL)
|
|
goto failed;
|
|
stream->workspace = kmalloc(zlib_inflate_workspacesize(),
|
|
GFP_KERNEL);
|
|
if (stream->workspace == NULL)
|
|
goto failed;
|
|
|
|
return stream;
|
|
|
|
failed:
|
|
ERROR("Failed to allocate zlib workspace\n");
|
|
kfree(stream);
|
|
return NULL;
|
|
}
|
|
|
|
|
|
static void zlib_free(void *strm)
|
|
{
|
|
z_stream *stream = strm;
|
|
|
|
if (stream)
|
|
kfree(stream->workspace);
|
|
kfree(stream);
|
|
}
|
|
|
|
|
|
static int zlib_uncompress(struct squashfs_sb_info *msblk, void **buffer,
|
|
struct buffer_head **bh, int b, int offset, int length, int srclength,
|
|
int pages)
|
|
{
|
|
int zlib_err, zlib_init = 0;
|
|
int k = 0, page = 0;
|
|
z_stream *stream = msblk->stream;
|
|
|
|
mutex_lock(&msblk->read_data_mutex);
|
|
|
|
stream->avail_out = 0;
|
|
stream->avail_in = 0;
|
|
|
|
do {
|
|
if (stream->avail_in == 0 && k < b) {
|
|
int avail = min(length, msblk->devblksize - offset);
|
|
length -= avail;
|
|
wait_on_buffer(bh[k]);
|
|
if (!buffer_uptodate(bh[k]))
|
|
goto release_mutex;
|
|
|
|
stream->next_in = bh[k]->b_data + offset;
|
|
stream->avail_in = avail;
|
|
offset = 0;
|
|
}
|
|
|
|
if (stream->avail_out == 0 && page < pages) {
|
|
stream->next_out = buffer[page++];
|
|
stream->avail_out = PAGE_CACHE_SIZE;
|
|
}
|
|
|
|
if (!zlib_init) {
|
|
zlib_err = zlib_inflateInit(stream);
|
|
if (zlib_err != Z_OK) {
|
|
ERROR("zlib_inflateInit returned unexpected "
|
|
"result 0x%x, srclength %d\n",
|
|
zlib_err, srclength);
|
|
goto release_mutex;
|
|
}
|
|
zlib_init = 1;
|
|
}
|
|
|
|
zlib_err = zlib_inflate(stream, Z_SYNC_FLUSH);
|
|
|
|
if (stream->avail_in == 0 && k < b)
|
|
put_bh(bh[k++]);
|
|
} while (zlib_err == Z_OK);
|
|
|
|
if (zlib_err != Z_STREAM_END) {
|
|
ERROR("zlib_inflate error, data probably corrupt\n");
|
|
goto release_mutex;
|
|
}
|
|
|
|
zlib_err = zlib_inflateEnd(stream);
|
|
if (zlib_err != Z_OK) {
|
|
ERROR("zlib_inflate error, data probably corrupt\n");
|
|
goto release_mutex;
|
|
}
|
|
|
|
if (k < b) {
|
|
ERROR("zlib_uncompress error, data remaining\n");
|
|
goto release_mutex;
|
|
}
|
|
|
|
length = stream->total_out;
|
|
mutex_unlock(&msblk->read_data_mutex);
|
|
return length;
|
|
|
|
release_mutex:
|
|
mutex_unlock(&msblk->read_data_mutex);
|
|
|
|
for (; k < b; k++)
|
|
put_bh(bh[k]);
|
|
|
|
return -EIO;
|
|
}
|
|
|
|
const struct squashfs_decompressor squashfs_zlib_comp_ops = {
|
|
.init = zlib_init,
|
|
.free = zlib_free,
|
|
.decompress = zlib_uncompress,
|
|
.id = ZLIB_COMPRESSION,
|
|
.name = "zlib",
|
|
.supported = 1
|
|
};
|
|
|