]> git.ipfire.org Git - thirdparty/xz.git/commit
liblzma: lzma_filters_copy: Keep dest[] unmodified if an error occurs.
authorLasse Collin <lasse.collin@tukaani.org>
Fri, 9 Sep 2022 10:51:57 +0000 (13:51 +0300)
committerLasse Collin <lasse.collin@tukaani.org>
Fri, 9 Sep 2022 10:51:57 +0000 (13:51 +0300)
commitf8ee61e74eb40600445fdb601c374d582e1e9c8a
tree7f2d7b0545b4824a91b3947b220b77987c791ba3
parent18d7facd3802b55c287581405c4d49c98708c136
liblzma: lzma_filters_copy: Keep dest[] unmodified if an error occurs.

lzma_stream_encoder() and lzma_stream_encoder_mt() always assumed
this. Before this patch, failing lzma_filters_copy() could result
in free(invalid_pointer) or invalid memory reads in stream_encoder.c
or stream_encoder_mt.c.

To trigger this, allocating memory for a filter options structure
has to fail. These are tiny allocations so in practice they very
rarely fail.

Certain badness in the filter chain array could also make
lzma_filters_copy() fail but both stream_encoder.c and
stream_encoder_mt.c validate the filter chain before
trying to copy it, so the crash cannot occur this way.
src/liblzma/api/lzma/filter.h
src/liblzma/common/filter_common.c