emo/busybox
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

bzip2: fix two crashes on corrupted archives

Browse Source 
As it turns out, longjmp'ing into freed stack is not healthy...

function                                             old     new   delta
unpack_usage_messages                                  -      97     +97
unpack_bz2_stream                                    369     409     +40
get_next_block                                      1667    1677     +10
get_bits                                             156     155      -1
start_bunzip                                         212     183     -29
bb_show_usage                                        181     120     -61
------------------------------------------------------------------------------
(add/remove: 1/0 grow/shrink: 2/3 up/down: 147/-91)            Total: 56 bytes

Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
This commit is contained in:
Denys Vlasenko
2018-04-08 20:02:01 +02:00
parent 8e2174e9bd
commit 38ccd6af8a
10 changed files with 99 additions and 36 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
libbb/appletlib.c
View File

@ -102,14 +102,21 @@ static const char *unpack_usage_messages(void)
char *outbuf = NULL;
bunzip_data *bd;
int i;
jmp_buf jmpbuf;
i = start_bunzip(&bd,
/* Setup for I/O error handling via longjmp */
i = setjmp(jmpbuf);
if (i == 0) {
i = start_bunzip(&jmpbuf,
&bd,
/* src_fd: */ -1,
/* inbuf: */ packed_usage,
/* len: */ sizeof(packed_usage));
/* read_bunzip can longjmp to start_bunzip, and ultimately
* end up here with i != 0 on read data errors! Not trivial */
if (!i) {
/* len: */ sizeof(packed_usage)
);
}
/* read_bunzip can longjmp and end up here with i != 0
* on read data errors! Not trivial */
if (i == 0) {
/* Cannot use xmalloc: will leak bd in NOFORK case! */
outbuf = malloc_or_warn(sizeof(UNPACKED_USAGE));
if (outbuf)