The patch titled
squashfs: fix use of uninitialised variable in zlib & xz decompressors
has been removed from the -mm tree. Its filename was
squashfs-fix-use-of-uninitialised-variable-in-zlib-xz-decompressors.patch
This patch was dropped because it was merged into mainline or a subsystem tree
The current -mm tree may be found at http://userweb.kernel.org/~akpm/mmotm/
------------------------------------------------------
Subject: squashfs: fix use of uninitialised variable in zlib & xz decompressors
From: Phillip Lougher <phillip@xxxxxxxxxxxxxxxxxxx>
Fix potential use of uninitialised variable caused by recent decompressor
code optimisations.
In zlib_uncompress (zlib_wrapper.c) we have
int zlib_err, zlib_init = 0;
...
do {
...
if (avail == 0) {
offset = 0;
put_bh(bh[k++]);
continue;
}
...
zlib_err = zlib_inflate(stream, Z_SYNC_FLUSH);
...
} while (zlib_err == Z_OK);
If continue is executed (avail == 0) then the while condition will be
evaluated testing zlib_err, which is uninitialised first time around the
loop.
Fix this by getting rid of the 'if (avail == 0)' condition test, this edge
condition should not be being handled in the decompressor code, and
instead handle it generically in the caller code.
Similarly for xz_wrapper.c.
Incidentally, on most architectures (bar Mips and Parisc), no
uninitialised variable warning is generated by gcc, this is because the
while condition test on continue is optimised out and not performed (when
executing continue zlib_err has not been changed since entering the loop,
and logically if the while condition was true previously, then it's still
true).
Signed-off-by: Phillip Lougher <phillip@xxxxxxxxxxxxxxxxxxx>
Reported-by: Jesper Juhl <jj@xxxxxxxxxxxxx>
Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx>
---
fs/squashfs/block.c | 8 ++++++++
fs/squashfs/xz_wrapper.c | 6 ------
fs/squashfs/zlib_wrapper.c | 6 ------
3 files changed, 8 insertions(+), 12 deletions(-)
diff -puN fs/squashfs/block.c~squashfs-fix-use-of-uninitialised-variable-in-zlib-xz-decompressors fs/squashfs/block.c
--- a/fs/squashfs/block.c~squashfs-fix-use-of-uninitialised-variable-in-zlib-xz-decompressors
+++ a/fs/squashfs/block.c
@@ -63,6 +63,14 @@ static struct buffer_head *get_block_len
*length = (unsigned char) bh->b_data[*offset] |
(unsigned char) bh->b_data[*offset + 1] << 8;
*offset += 2;
+
+ if (*offset == msblk->devblksize) {
+ put_bh(bh);
+ bh = sb_bread(sb, ++(*cur_index));
+ if (bh == NULL)
+ return NULL;
+ *offset = 0;
+ }
}
return bh;
diff -puN fs/squashfs/xz_wrapper.c~squashfs-fix-use-of-uninitialised-variable-in-zlib-xz-decompressors fs/squashfs/xz_wrapper.c
--- a/fs/squashfs/xz_wrapper.c~squashfs-fix-use-of-uninitialised-variable-in-zlib-xz-decompressors
+++ a/fs/squashfs/xz_wrapper.c
@@ -95,12 +95,6 @@ static int squashfs_xz_uncompress(struct
if (!buffer_uptodate(bh[k]))
goto release_mutex;
- if (avail == 0) {
- offset = 0;
- put_bh(bh[k++]);
- continue;
- }
-
stream->buf.in = bh[k]->b_data + offset;
stream->buf.in_size = avail;
stream->buf.in_pos = 0;
diff -puN fs/squashfs/zlib_wrapper.c~squashfs-fix-use-of-uninitialised-variable-in-zlib-xz-decompressors fs/squashfs/zlib_wrapper.c
--- a/fs/squashfs/zlib_wrapper.c~squashfs-fix-use-of-uninitialised-variable-in-zlib-xz-decompressors
+++ a/fs/squashfs/zlib_wrapper.c
@@ -82,12 +82,6 @@ static int zlib_uncompress(struct squash
if (!buffer_uptodate(bh[k]))
goto release_mutex;
- if (avail == 0) {
- offset = 0;
- put_bh(bh[k++]);
- continue;
- }
-
stream->next_in = bh[k]->b_data + offset;
stream->avail_in = avail;
offset = 0;
_
Patches currently in -mm which might be from phillip@xxxxxxxxxxxxxxxxxxx are
origin.patch
--
To unsubscribe from this list: send the line "unsubscribe mm-commits" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
