[coreboot-gerrit] Change in coreboot[master]: libpayload: Fix out-of-bounds read

[Alexandre Rebert (Code Review)]

Alexandre Rebert has uploaded this change for review. ( https://review.coreboot.org/c/coreboot/+/39033 )

Change subject: libpayload: Fix out-of-bounds read
......................................................................

libpayload: Fix out-of-bounds read

Fix an out-of-bounds read in the LZMA decoder which happens when the src
buffer is too small to contain the 13-byte LZMA header.

Change-Id: Ie442f82cd1abcf7fa18295e782cccf26a7d30079
Signed-off-by: Alex Rebert 
---
M payloads/libpayload/liblzma/lzma.c
1 file changed, 5 insertions(+), 0 deletions(-)

git pull ssh://review.coreboot.org:29418/coreboot refs/changes/33/39033/1

diff --git a/payloads/libpayload/liblzma/lzma.c b/payloads/libpayload/liblzma/lzma.c
index 57a8b3a..132ae84 100644
--- a/payloads/libpayload/liblzma/lzma.c
+++ b/payloads/libpayload/liblzma/lzma.c
@@ -28,6 +28,11 @@
    SizeT mallocneeds;
    unsigned char *scratchpad;

+	if (srcn < data_offset) {
+		printf("lzma: Input too small.")
+		return 0;
+	}
+
    memcpy(properties, src, LZMA_PROPERTIES_SIZE);
    memcpy(&outSize, src + LZMA_PROPERTIES_SIZE, sizeof(outSize));
    if (outSize > dstn)