Change in coreboot[master]: lib/lzma: Fix out-of-bounds read

[Alexandre Rebert (Code Review)]

Alexandre Rebert has uploaded this change for review. ( https://review.coreboot.org/c/coreboot/+/39085 )

Change subject: lib/lzma: Fix out-of-bounds read
......................................................................

lib/lzma: Fix out-of-bounds read

Fix an out-of-bounds read in the LZMA decoder which happens when the src
buffer is too small to contain the 13-byte LZMA header.

Change-Id: Id5893e60fc9a48deb83560b7917f5558cd30ef4e
Signed-off-by: Alex Rebert 
Found-by: Mayhem
---
M src/lib/lzma.c
1 file changed, 5 insertions(+), 0 deletions(-)

git pull ssh://review.coreboot.org:29418/coreboot refs/changes/85/39085/1

diff --git a/src/lib/lzma.c b/src/lib/lzma.c
index 71c016e..16b6e22 100644
--- a/src/lib/lzma.c
+++ b/src/lib/lzma.c
@@ -29,6 +29,11 @@
    MAYBE_STATIC_BSS unsigned char scratchpad[15980];
    const unsigned char *cp;

+	if (srcn < data_offset) {
+		printk(BIOS_WARNING, "lzma: Input too small.\n");
+		return 0;
+	}
+
    memcpy(properties, src, LZMA_PROPERTIES_SIZE);
    /* The outSize in LZMA stream is a 64bit integer stored in little-endian
     * (ref: lzma.cc@LZMACompress: put_64). To prevent accessing by

[Julius Werner (Code Review)]

Julius Werner has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/39085 )

Change subject: lib/lzma: Fix out-of-bounds read
......................................................................

Patch Set 1: Code-Review+2

[Patrick Georgi (Code Review)]

Patrick Georgi has submitted this change. ( https://review.coreboot.org/c/coreboot/+/39085 )

Change subject: lib/lzma: Fix out-of-bounds read
......................................................................

lib/lzma: Fix out-of-bounds read

Fix an out-of-bounds read in the LZMA decoder which happens when the src
buffer is too small to contain the 13-byte LZMA header.

Change-Id: Id5893e60fc9a48deb83560b7917f5558cd30ef4e
Signed-off-by: Alex Rebert 
Found-by: Mayhem
Reviewed-on: https://review.coreboot.org/c/coreboot/+/39085
Tested-by: build bot (Jenkins) 
Reviewed-by: Julius Werner 
---
M src/lib/lzma.c
1 file changed, 5 insertions(+), 0 deletions(-)

Approvals:
  build bot (Jenkins): Verified
  Julius Werner: Looks good to me, approved

diff --git a/src/lib/lzma.c b/src/lib/lzma.c
index 71c016e..16b6e22 100644
--- a/src/lib/lzma.c
+++ b/src/lib/lzma.c
@@ -29,6 +29,11 @@
    MAYBE_STATIC_BSS unsigned char scratchpad[15980];
    const unsigned char *cp;

+	if (srcn < data_offset) {
+		printk(BIOS_WARNING, "lzma: Input too small.\n");
+		return 0;
+	}
+
    memcpy(properties, src, LZMA_PROPERTIES_SIZE);
    /* The outSize in LZMA stream is a 64bit integer stored in little-endian
     * (ref: lzma.cc@LZMACompress: put_64). To prevent accessing by