Skip to content

Commit

Permalink
squashfs: fix use of uninitialised variable in zlib & xz decompressors
Browse files Browse the repository at this point in the history
Fix potential use of uninitialised variable caused by recent
decompressor code optimisations.

In zlib_uncompress (zlib_wrapper.c) we have

	int zlib_err, zlib_init = 0;
	...
	do {
		...
			if (avail == 0) {
				offset = 0;
				put_bh(bh[k++]);
				continue;
			}
		...
		zlib_err = zlib_inflate(stream, Z_SYNC_FLUSH);
		...
	} while (zlib_err == Z_OK);

If continue is executed (avail == 0) then the while condition will be
evaluated testing zlib_err, which is uninitialised first time around the
loop.

Fix this by getting rid of the 'if (avail == 0)' condition test, this
edge condition should not be being handled in the decompressor code, and
instead handle it generically in the caller code.

Similarly for xz_wrapper.c.

Incidentally, on most architectures (bar Mips and Parisc), no
uninitialised variable warning is generated by gcc, this is because the
while condition test on continue is optimised out and not performed
(when executing continue zlib_err has not been changed since entering
the loop, and logically if the while condition was true previously, then
it's still true).

Signed-off-by: Phillip Lougher <[email protected]>
Reported-by: Jesper Juhl <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>
  • Loading branch information
Phillip Lougher authored and torvalds committed Jan 26, 2011
1 parent ac15ee6 commit 3689456
Show file tree
Hide file tree
Showing 3 changed files with 8 additions and 12 deletions.
8 changes: 8 additions & 0 deletions fs/squashfs/block.c
Original file line number Diff line number Diff line change
Expand Up @@ -63,6 +63,14 @@ static struct buffer_head *get_block_length(struct super_block *sb,
*length = (unsigned char) bh->b_data[*offset] |
(unsigned char) bh->b_data[*offset + 1] << 8;
*offset += 2;

if (*offset == msblk->devblksize) {
put_bh(bh);
bh = sb_bread(sb, ++(*cur_index));
if (bh == NULL)
return NULL;
*offset = 0;
}
}

return bh;
Expand Down
6 changes: 0 additions & 6 deletions fs/squashfs/xz_wrapper.c
Original file line number Diff line number Diff line change
Expand Up @@ -95,12 +95,6 @@ static int squashfs_xz_uncompress(struct squashfs_sb_info *msblk, void **buffer,
if (!buffer_uptodate(bh[k]))
goto release_mutex;

if (avail == 0) {
offset = 0;
put_bh(bh[k++]);
continue;
}

stream->buf.in = bh[k]->b_data + offset;
stream->buf.in_size = avail;
stream->buf.in_pos = 0;
Expand Down
6 changes: 0 additions & 6 deletions fs/squashfs/zlib_wrapper.c
Original file line number Diff line number Diff line change
Expand Up @@ -82,12 +82,6 @@ static int zlib_uncompress(struct squashfs_sb_info *msblk, void **buffer,
if (!buffer_uptodate(bh[k]))
goto release_mutex;

if (avail == 0) {
offset = 0;
put_bh(bh[k++]);
continue;
}

stream->next_in = bh[k]->b_data + offset;
stream->avail_in = avail;
offset = 0;
Expand Down

0 comments on commit 3689456

Please sign in to comment.