]> git.ipfire.org Git - people/ms/linux.git/blame - lib/lz4/lz4_decompress.c
LZ4 : fix the data abort issue
[people/ms/linux.git] / lib / lz4 / lz4_decompress.c
CommitLineData
cffb78b0
KL
1/*
2 * LZ4 Decompressor for Linux kernel
3 *
e76e1fdf 4 * Copyright (C) 2013, LG Electronics, Kyungsik Lee <kyungsik.lee@lge.com>
cffb78b0
KL
5 *
6 * Based on LZ4 implementation by Yann Collet.
7 *
8 * LZ4 - Fast LZ compression algorithm
9 * Copyright (C) 2011-2012, Yann Collet.
10 * BSD 2-Clause License (http://www.opensource.org/licenses/bsd-license.php)
11 *
12 * Redistribution and use in source and binary forms, with or without
13 * modification, are permitted provided that the following conditions are
14 * met:
15 *
16 * * Redistributions of source code must retain the above copyright
17 * notice, this list of conditions and the following disclaimer.
18 * * Redistributions in binary form must reproduce the above
19 * copyright notice, this list of conditions and the following disclaimer
20 * in the documentation and/or other materials provided with the
21 * distribution.
22 *
23 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
24 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
25 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
26 * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
27 * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
28 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
29 * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
30 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
31 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
32 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
33 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
34 *
35 * You can contact the author at :
36 * - LZ4 homepage : http://fastcompression.blogspot.com/p/lz4.html
37 * - LZ4 source repository : http://code.google.com/p/lz4/
38 */
39
40#ifndef STATIC
41#include <linux/module.h>
42#include <linux/kernel.h>
43#endif
44#include <linux/lz4.h>
45
46#include <asm/unaligned.h>
47
48#include "lz4defs.h"
49
50static int lz4_uncompress(const char *source, char *dest, int osize)
51{
52 const BYTE *ip = (const BYTE *) source;
53 const BYTE *ref;
54 BYTE *op = (BYTE *) dest;
55 BYTE * const oend = op + osize;
56 BYTE *cpy;
57 unsigned token;
58 size_t length;
59 size_t dec32table[] = {0, 3, 2, 3, 0, 0, 0, 0};
60#if LZ4_ARCH64
61 size_t dec64table[] = {0, 0, 0, -1, 0, 1, 2, 3};
62#endif
63
64 while (1) {
65
66 /* get runlength */
67 token = *ip++;
68 length = (token >> ML_BITS);
69 if (length == RUN_MASK) {
70 size_t len;
71
72 len = *ip++;
73 for (; len == 255; length += 255)
74 len = *ip++;
206204a1
GKH
75 if (unlikely(length > (size_t)(length + len)))
76 goto _output_error;
cffb78b0
KL
77 length += len;
78 }
79
80 /* copy literals */
81 cpy = op + length;
82 if (unlikely(cpy > oend - COPYLENGTH)) {
83 /*
84 * Error: not enough place for another match
85 * (min 4) + 5 literals
86 */
87 if (cpy != oend)
88 goto _output_error;
89
90 memcpy(op, ip, length);
91 ip += length;
92 break; /* EOF */
93 }
94 LZ4_WILDCOPY(ip, op, cpy);
95 ip -= (op - cpy);
96 op = cpy;
97
98 /* get offset */
99 LZ4_READ_LITTLEENDIAN_16(ref, cpy, ip);
100 ip += 2;
101
102 /* Error: offset create reference outside destination buffer */
103 if (unlikely(ref < (BYTE *const) dest))
104 goto _output_error;
105
106 /* get matchlength */
107 length = token & ML_MASK;
108 if (length == ML_MASK) {
109 for (; *ip == 255; length += 255)
110 ip++;
4148c1f6
GKH
111 if (unlikely(length > (size_t)(length + *ip)))
112 goto _output_error;
cffb78b0
KL
113 length += *ip++;
114 }
115
116 /* copy repeated sequence */
117 if (unlikely((op - ref) < STEPSIZE)) {
118#if LZ4_ARCH64
119 size_t dec64 = dec64table[op - ref];
120#else
121 const int dec64 = 0;
122#endif
123 op[0] = ref[0];
124 op[1] = ref[1];
125 op[2] = ref[2];
126 op[3] = ref[3];
127 op += 4;
128 ref += 4;
129 ref -= dec32table[op-ref];
130 PUT4(ref, op);
131 op += STEPSIZE - 4;
132 ref -= dec64;
133 } else {
134 LZ4_COPYSTEP(ref, op);
135 }
136 cpy = op + length - (STEPSIZE - 4);
137 if (cpy > (oend - COPYLENGTH)) {
138
139 /* Error: request to write beyond destination buffer */
140 if (cpy > oend)
141 goto _output_error;
d5e7cafd
JY
142 if ((ref + COPYLENGTH) > oend ||
143 (op + COPYLENGTH) > oend)
144 goto _output_error;
cffb78b0
KL
145 LZ4_SECURECOPY(ref, op, (oend - COPYLENGTH));
146 while (op < cpy)
147 *op++ = *ref++;
148 op = cpy;
149 /*
150 * Check EOF (should never happen, since last 5 bytes
151 * are supposed to be literals)
152 */
153 if (op == oend)
154 goto _output_error;
155 continue;
156 }
157 LZ4_SECURECOPY(ref, op, cpy);
158 op = cpy; /* correction */
159 }
160 /* end of decoding */
161 return (int) (((char *)ip) - source);
162
163 /* write overflow error detected */
164_output_error:
4148c1f6 165 return -1;
cffb78b0
KL
166}
167
168static int lz4_uncompress_unknownoutputsize(const char *source, char *dest,
169 int isize, size_t maxoutputsize)
170{
171 const BYTE *ip = (const BYTE *) source;
172 const BYTE *const iend = ip + isize;
173 const BYTE *ref;
174
175
176 BYTE *op = (BYTE *) dest;
177 BYTE * const oend = op + maxoutputsize;
178 BYTE *cpy;
179
180 size_t dec32table[] = {0, 3, 2, 3, 0, 0, 0, 0};
181#if LZ4_ARCH64
182 size_t dec64table[] = {0, 0, 0, -1, 0, 1, 2, 3};
183#endif
184
185 /* Main Loop */
186 while (ip < iend) {
187
188 unsigned token;
189 size_t length;
190
191 /* get runlength */
192 token = *ip++;
193 length = (token >> ML_BITS);
194 if (length == RUN_MASK) {
195 int s = 255;
196 while ((ip < iend) && (s == 255)) {
197 s = *ip++;
4a3a9904
GKH
198 if (unlikely(length > (size_t)(length + s)))
199 goto _output_error;
cffb78b0
KL
200 length += s;
201 }
202 }
203 /* copy literals */
204 cpy = op + length;
205 if ((cpy > oend - COPYLENGTH) ||
206 (ip + length > iend - COPYLENGTH)) {
207
208 if (cpy > oend)
209 goto _output_error;/* writes beyond buffer */
210
211 if (ip + length != iend)
212 goto _output_error;/*
213 * Error: LZ4 format requires
214 * to consume all input
215 * at this stage
216 */
217 memcpy(op, ip, length);
218 op += length;
219 break;/* Necessarily EOF, due to parsing restrictions */
220 }
221 LZ4_WILDCOPY(ip, op, cpy);
222 ip -= (op - cpy);
223 op = cpy;
224
225 /* get offset */
226 LZ4_READ_LITTLEENDIAN_16(ref, cpy, ip);
227 ip += 2;
228 if (ref < (BYTE * const) dest)
229 goto _output_error;
230 /*
231 * Error : offset creates reference
232 * outside of destination buffer
233 */
234
235 /* get matchlength */
236 length = (token & ML_MASK);
237 if (length == ML_MASK) {
238 while (ip < iend) {
239 int s = *ip++;
4a3a9904
GKH
240 if (unlikely(length > (size_t)(length + s)))
241 goto _output_error;
cffb78b0
KL
242 length += s;
243 if (s == 255)
244 continue;
245 break;
246 }
247 }
248
249 /* copy repeated sequence */
250 if (unlikely((op - ref) < STEPSIZE)) {
251#if LZ4_ARCH64
252 size_t dec64 = dec64table[op - ref];
253#else
254 const int dec64 = 0;
255#endif
256 op[0] = ref[0];
257 op[1] = ref[1];
258 op[2] = ref[2];
259 op[3] = ref[3];
260 op += 4;
261 ref += 4;
262 ref -= dec32table[op - ref];
263 PUT4(ref, op);
264 op += STEPSIZE - 4;
265 ref -= dec64;
266 } else {
267 LZ4_COPYSTEP(ref, op);
268 }
269 cpy = op + length - (STEPSIZE-4);
270 if (cpy > oend - COPYLENGTH) {
271 if (cpy > oend)
272 goto _output_error; /* write outside of buf */
273
274 LZ4_SECURECOPY(ref, op, (oend - COPYLENGTH));
275 while (op < cpy)
276 *op++ = *ref++;
277 op = cpy;
278 /*
279 * Check EOF (should never happen, since last 5 bytes
280 * are supposed to be literals)
281 */
282 if (op == oend)
283 goto _output_error;
284 continue;
285 }
286 LZ4_SECURECOPY(ref, op, cpy);
287 op = cpy; /* correction */
288 }
289 /* end of decoding */
290 return (int) (((char *) op) - dest);
291
292 /* write overflow error detected */
293_output_error:
4a3a9904 294 return -1;
cffb78b0
KL
295}
296
b34081f1
SS
297int lz4_decompress(const unsigned char *src, size_t *src_len,
298 unsigned char *dest, size_t actual_dest_len)
cffb78b0
KL
299{
300 int ret = -1;
301 int input_len = 0;
302
303 input_len = lz4_uncompress(src, dest, actual_dest_len);
304 if (input_len < 0)
305 goto exit_0;
306 *src_len = input_len;
307
308 return 0;
309exit_0:
310 return ret;
311}
312#ifndef STATIC
ee8a99bd 313EXPORT_SYMBOL(lz4_decompress);
cffb78b0
KL
314#endif
315
b34081f1
SS
316int lz4_decompress_unknownoutputsize(const unsigned char *src, size_t src_len,
317 unsigned char *dest, size_t *dest_len)
cffb78b0
KL
318{
319 int ret = -1;
320 int out_len = 0;
321
322 out_len = lz4_uncompress_unknownoutputsize(src, dest, src_len,
323 *dest_len);
324 if (out_len < 0)
325 goto exit_0;
326 *dest_len = out_len;
327
328 return 0;
329exit_0:
330 return ret;
331}
332#ifndef STATIC
ee8a99bd 333EXPORT_SYMBOL(lz4_decompress_unknownoutputsize);
cffb78b0 334
ee8a99bd 335MODULE_LICENSE("Dual BSD/GPL");
cffb78b0
KL
336MODULE_DESCRIPTION("LZ4 Decompressor");
337#endif