Changeset 3621 in MondoRescue for branches/3.3/mindi-busybox/archival/libarchive/decompress_gunzip.c

Timestamp:

Dec 20, 2016, 4:07:32 PM (7 years ago)

Author:

Bruno Cornec

Message:

New 3?3 banch for incorporation of latest busybox 1.25. Changing minor version to handle potential incompatibilities.

Location:

branches/3.3

Files:

• . (copied) (copied from branches/3.2 )
• mindi-busybox/archival/libarchive/decompress_gunzip.c (modified) (23 diffs)

branches/3.3/mindi-busybox/archival/libarchive/decompress_gunzip.c

@@ -306 +306 @@
     unsigned j;             /* counter */
     int k;                  /* number of bits in current code */
-    unsigned *p;            /* pointer into c[], b[], or v[] */
+    const unsigned *p;      /* pointer into c[], b[], or v[] */
     huft_t *q;              /* points to current table */
     huft_t r;               /* table entry for structure assignment */
     huft_t *u[BMAX];        /* table stack */
-    unsigned v[N_MAX];      /* values in order of bit length */
+    unsigned v[N_MAX + 1];  /* values in order of bit length. last v[] is never used */
     int ws[BMAX + 1];       /* bits decoded stack */
     int w;                  /* bits decoded */
@@ -325 +325 @@
     /* Generate counts for each bit length */
     memset(c, 0, sizeof(c));
-    p = (unsigned *) b; /* cast allows us to reuse p for pointing to b */
+    p = b;
     i = n;
     do {
@@ -337 +337 @@
 
     /* Find minimum and maximum length, bound *m by those */
-    for (j = 1; (c[j] == 0) && (j <= BMAX); j++)
+    for (j = 1; (j <= BMAX) && (c[j] == 0); j++)
         continue;
     k = j; /* minimum code length */
@@ -365 +365 @@
     }
 
-    /* Make a table of values in order of bit lengths */
-    p = (unsigned *) b;
+    /* Make a table of values in order of bit lengths.
+     * To detect bad input, unused v[i]'s are set to invalid value UINT_MAX.
+     * In particular, last v[i] is never filled and must not be accessed.
+     */
+    memset(v, 0xff, sizeof(v));
+    p = b;
     i = 0;
     do {
@@ -433 +437 @@
             /* set up table entry in r */
             r.b = (unsigned char) (k - w);
-            if (p >= v + n) {
+            if (/*p >= v + n || -- redundant, caught by the second check: */
+                *p == UINT_MAX /* do we access uninited v[i]? (see memset(v))*/
+            ) {
                 r.e = 99; /* out of values--invalid code */
             } else if (*p < s) {
@@ -518 +524 @@
         if (e > 16)
             do {
-                if (e == 99)
-                    abort_unzip(PASS_STATE_ONLY);;
+                if (e == 99) {
+                    abort_unzip(PASS_STATE_ONLY);
+                }
                 bb >>= t->b;
                 k -= t->b;
@@ -555 +562 @@
             if (e > 16)
                 do {
-                    if (e == 99)
+                    if (e == 99) {
                         abort_unzip(PASS_STATE_ONLY);
+                    }
                     bb >>= t->b;
                     k -= t->b;
@@ -822 +830 @@
         b_dynamic >>= 4;
         k_dynamic -= 4;
-        if (nl > 286 || nd > 30)
+        if (nl > 286 || nd > 30) {
             abort_unzip(PASS_STATE_ONLY);   /* bad lengths */
+        }
 
         /* read in bit-length-code lengths */
@@ -904 +913 @@
 
         i = huft_build(ll, nl, 257, cplens, cplext, &inflate_codes_tl, &bl);
-        if (i != 0)
+        if (i != 0) {
             abort_unzip(PASS_STATE_ONLY);
+        }
         bd = dbits;
         i = huft_build(ll + nl, nd, 0, cpdist, cpdext, &inflate_codes_td, &bd);
-        if (i != 0)
+        if (i != 0) {
             abort_unzip(PASS_STATE_ONLY);
+        }
 
         /* set up data for inflate_codes() */
@@ -972 +983 @@
 /* Called from unpack_gz_stream() and inflate_unzip() */
 static IF_DESKTOP(long long) int
-inflate_unzip_internal(STATE_PARAM int in, int out)
+inflate_unzip_internal(STATE_PARAM transformer_state_t *xstate)
 {
     IF_DESKTOP(long long) int n = 0;
@@ -981 +992 @@
     gunzip_outbuf_count = 0;
     gunzip_bytes_out = 0;
-    gunzip_src_fd = in;
+    gunzip_src_fd = xstate->src_fd;
 
     /* (re) initialize state */
@@ -997 +1008 @@
     if (setjmp(error_jmp)) {
         /* Error from deep inside zip machinery */
+        bb_error_msg(error_msg);
         n = -1;
         goto ret;
@@ -1003 +1015 @@
     while (1) {
         int r = inflate_get_next_window(PASS_STATE_ONLY);
-        nwrote = full_write(out, gunzip_window, gunzip_outbuf_count);
-        if (nwrote != (ssize_t)gunzip_outbuf_count) {
-            bb_perror_msg("write");
+        nwrote = transformer_write(xstate, gunzip_window, gunzip_outbuf_count);
+        if (nwrote == (ssize_t)-1) {
             n = -1;
             goto ret;
@@ -1035 +1046 @@
 
 IF_DESKTOP(long long) int FAST_FUNC
-inflate_unzip(transformer_aux_data_t *aux, int in, int out)
+inflate_unzip(transformer_state_t *xstate)
 {
     IF_DESKTOP(long long) int n;
@@ -1042 +1053 @@
     ALLOC_STATE;
 
-    to_read = aux->bytes_in;
+    to_read = xstate->bytes_in;
 //  bytebuffer_max = 0x8000;
     bytebuffer_offset = 4;
     bytebuffer = xmalloc(bytebuffer_max);
-    n = inflate_unzip_internal(PASS_STATE in, out);
+    n = inflate_unzip_internal(PASS_STATE xstate);
     free(bytebuffer);
 
-    aux->crc32 = gunzip_crc;
-    aux->bytes_out = gunzip_bytes_out;
+    xstate->crc32 = gunzip_crc;
+    xstate->bytes_out = gunzip_bytes_out;
     DEALLOC_STATE;
     return n;
@@ -1108 +1119 @@
 }
 
-static int check_header_gzip(STATE_PARAM transformer_aux_data_t *aux)
+static int check_header_gzip(STATE_PARAM transformer_state_t *xstate)
 {
     union {
@@ -1120 +1131 @@
         } PACKED formatted;
     } header;
-    struct BUG_header {
-        char BUG_header[sizeof(header) == 8 ? 1 : -1];
-    };
+
+    BUILD_BUG_ON(sizeof(header) != 8);
 
     /*
@@ -1170 +1180 @@
     }
 
-    if (aux)
-        aux->mtime = SWAP_LE32(header.formatted.mtime);
+    xstate->mtime = SWAP_LE32(header.formatted.mtime);
 
     /* Read the header checksum */
@@ -1183 +1192 @@
 
 IF_DESKTOP(long long) int FAST_FUNC
-unpack_gz_stream(transformer_aux_data_t *aux, int src_fd, int dst_fd)
+unpack_gz_stream(transformer_state_t *xstate)
 {
     uint32_t v32;
@@ -1190 +1199 @@
 
 #if !ENABLE_FEATURE_SEAMLESS_Z
-    if (check_signature16(aux, src_fd, GZIP_MAGIC))
+    if (check_signature16(xstate, GZIP_MAGIC))
         return -1;
 #else
-    if (aux && aux->check_signature) {
+    if (!xstate->signature_skipped) {
         uint16_t magic2;
 
-        if (full_read(src_fd, &magic2, 2) != 2) {
+        if (full_read(xstate->src_fd, &magic2, 2) != 2) {
  bad_magic:
             bb_error_msg("invalid magic");
@@ -1202 +1211 @@
         }
         if (magic2 == COMPRESS_MAGIC) {
-            aux->check_signature = 0;
-            return unpack_Z_stream(aux, src_fd, dst_fd);
+            xstate->signature_skipped = 2;
+            return unpack_Z_stream(xstate);
         }
         if (magic2 != GZIP_MAGIC)
@@ -1216 +1225 @@
 //  bytebuffer_max = 0x8000;
     bytebuffer = xmalloc(bytebuffer_max);
-    gunzip_src_fd = src_fd;
+    gunzip_src_fd = xstate->src_fd;
 
  again:
-    if (!check_header_gzip(PASS_STATE aux)) {
+    if (!check_header_gzip(PASS_STATE xstate)) {
         bb_error_msg("corrupted data");
         total = -1;
@@ -1225 +1234 @@
     }
 
-    n = inflate_unzip_internal(PASS_STATE src_fd, dst_fd);
+    n = inflate_unzip_internal(PASS_STATE xstate);
     if (n < 0) {
         total = -1;