Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
From:   Yueyi Li <liyueyi@live.com>
To:     Willy Tarreau <w@1wt.eu>
CC:     "gregkh@linuxfoundation.org" <gregkh@linuxfoundation.org>,
        "donb@securitymouse.com" <donb@securitymouse.com>,
        "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>
Subject: Re: [PATCH] lzo: fix ip overrun during compress.
Thread-Topic: [PATCH] lzo: fix ip overrun during compress.
Thread-Index: AQHUhjzFV7dxiksDcEGXoSZcs8ZKe6Vkk4UAgAAjrQA=
Date:   Wed, 28 Nov 2018 06:16:10 +0000
Message-ID: <BLUPR13MB0289DF5EA12E2D27D7908CF7DFD10@BLUPR13MB0289.namprd13.prod.outlook.com>
References: <BLUPR13MB0289FB16D885625827E8DD27DFD00@BLUPR13MB0289.namprd13.prod.outlook.com>
 <20181128040820.GC19711@1wt.eu>
In-Reply-To: <20181128040820.GC19711@1wt.eu>
Accept-Language: en-US, zh-CN
Content-Language: en-US
x-ms-exchange-messagesentrepresentingtype: 1
x-tmn:  [dLWNZb/rXNBlIccn9wJNVabO7aZJ023R]
x-ms-publictraffictype: Email
x-microsoft-exchange-diagnostics: 1;BY2NAM03HT048;6:m8HvjhWAOLTTGW5Y+UyLUu00SPdc9gKyCXSKTQ8JJcxhPHSdQ8JhsSNtttqLxov28mlbmDbzP3K7GnOCWWj4OB/BDBslkzvYIHXy9oEByRNPi1H7PSpiNr6jTsT3nAtG8wQrQPzjM+xuFIoZUAA8FVCJ5G+B8H0O+5LNnF+qyNZQU05idq9jhZmFGg2HMI1Zh8RVDy6C9mhtPH7bWHdZHT+R7/iJeaHSDdveycKoALBNdp6UIBYryiMJaEjdU8UXP6sI11Bov3lhh3J8AmqAsjA+4CMs0A1bode6beJ0q23vl7TURYPiJAs0Q1jGK+30vUW2VtcbTIsloS1Cf3RkKUSXYQpNxVEdIlQbPPyY6grAAdYxu5k3tG3C1vCIJLIfvgxTog+yRjRFv7JctYOGxW99lXusJknY5vK0EgzfbYRyrlGBSfF7+X3rIiKwvgAuNtzZ4bvelFiuSR2sGkEJyg==;5:M3xF9NGRv37bDNzphdsMdsW7ZJN5PPpj/98Q243OuBL75UWlTmKiK6VMfNG+0CChYnpAtHga/hvlm0jmxicyazauI3X5ItTWXYmrAiShN1kDOiEGReBzcQVU8f6NIdMCQ1fUY0ZxulKpLY/Cy7pwSdwTj99fgjHRQPFJsP1yYsc=;7:Arnxx2t5F8fBI4t4TffNHm+x2AXsMgI+h6MgTrxR7J5PkzMPlRgs5HyoUr2rK8jGM9bzXFdHF0ojhvVLOQPY7aoBgpdL7rUCYDWinOPwjjAWVVY3hMwDCWf3KRvhlhHnd1EzeoOBqHljCoYe2p3mIg==
x-incomingheadercount: 50
x-eopattributedmessage: 0
x-microsoft-antispam: BCL:0;PCL:0;RULEID:(2390098)(7020095)(201702061078)(5061506573)(5061507331)(1603103135)(2017031320274)(2017031324274)(2017031323274)(2017031322404)(1603101475)(1601125500)(1701031045);SRVR:BY2NAM03HT048;
x-ms-traffictypediagnostic: BY2NAM03HT048:
x-exchange-antispam-report-cfa-test: BCL:0;PCL:0;RULEID:(4566010)(82015058);SRVR:BY2NAM03HT048;BCL:0;PCL:0;RULEID:;SRVR:BY2NAM03HT048;
x-microsoft-antispam-message-info: rwzGcp+3j4nz67LhN09gH8VzhbvaFKu4qJlFVVlMGk9zVmhXEK4b3jIwgZAiZyQm
Content-Type: text/plain; charset="Windows-1252"
Content-ID: <5BABA93CE16A6A4B8652EC85464CC7B5@namprd13.prod.outlook.com>
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-OriginatorOrg: live.com
X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg: f12efbb0-867f-4c93-8261-502eceebfafa
X-MS-Exchange-CrossTenant-Network-Message-Id: a618ba1d-b12d-49ee-5ecc-08d654f8fd6f
X-MS-Exchange-CrossTenant-rms-persistedconsumerorg: f12efbb0-867f-4c93-8261-502eceebfafa
X-MS-Exchange-CrossTenant-originalarrivaltime: 28 Nov 2018 06:16:10.7116
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Internet
X-MS-Exchange-CrossTenant-id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa
X-MS-Exchange-Transport-CrossTenantHeadersStamped: BY2NAM03HT048
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

Hi Willy,


On 2018/11/28 12:08, Willy Tarreau wrote:
> Hi Yueyi,
>
> On Tue, Nov 27, 2018 at 10:34:26AM +0000, Yueyi Li wrote:
>> It`s possible ip overrun in lzo1x_1_do_compress() when compressed page i=
s
>> point to the end of memory and which virtual address is 0xfffffffffffff0=
00.
>> Leading to a NULL pointer access during the get_unaligned_le32(ip).
> Thanks for this report.
>
> (...)
>> diff --git a/lib/lzo/lzo1x_compress.c b/lib/lzo/lzo1x_compress.c
>> index 236eb21..a0265a6 100644
>> --- a/lib/lzo/lzo1x_compress.c
>> +++ b/lib/lzo/lzo1x_compress.c
>> @@ -17,6 +17,9 @@
>>   #include <linux/lzo.h>
>>   #include "lzodefs.h"
>>  =20
>> +#define OVERFLOW_ADD_CHECK(a, b)  \
>> +	((size_t)~0 - (size_t)(a) < (size_t)(b) ? true : false)
>> +
> I think the test would be easier to grasp this way :
>
> #define OVERFLOW_ADD_CHECK(a, b)  \
> 	((size_t)(b) >=3D (size_t)((void*)0 - (void *)(a)))
>
> But the following should be more efficient since we build with
> -fno-strict-overflow :
>
> #define OVERFLOW_ADD_CHECK(a, b)  \
> 	(((a) + (b)) < (a))
Thanks for the suggestion,  I will change it in next version.
> Could you please recheck ?
>
> Thanks,
> Willy

Thanks,
Yueyi