|
| 1 | +From afad21b3b9c9089f1b1634bd2dcf57764b1e5bf5 Mon Sep 17 00:00:00 2001 |
| 2 | +From: Lasse Collin <lasse.collin@tukaani.org> |
| 3 | +Date: Sun, 29 Mar 2026 19:11:21 +0300 |
| 4 | +Subject: [PATCH] liblzma: Fix a buffer overflow in lzma_index_append() |
| 5 | + |
| 6 | +If lzma_index_decoder() was used to decode an Index that contained no |
| 7 | +Records, the resulting lzma_index had an invalid internal "prealloc" |
| 8 | +value. If lzma_index_append() was called on this lzma_index, too |
| 9 | +little memory would be allocated and a buffer overflow would occur. |
| 10 | + |
| 11 | +While this combination of the API functions is meant to work, in the |
| 12 | +real-world apps this call sequence is rare or might not exist at all. |
| 13 | + |
| 14 | +This bug is older than xz 5.0.0, so all stable releases are affected. |
| 15 | + |
| 16 | +Reported-by: GitHub user christos-spearbit |
| 17 | +(cherry picked from commit c8c22869e780ff57c96b46939c3d79ff99395f87) |
| 18 | +Signed-off-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> |
| 19 | +Upstream-reference: https://github.com/tukaani-project/xz/commit/8538443d08591693a8c61f3a03656650f39c7c32.patch |
| 20 | +--- |
| 21 | + src/liblzma/common/index.c | 21 +++++++++++++++++++++ |
| 22 | + 1 file changed, 21 insertions(+) |
| 23 | + |
| 24 | +diff --git a/src/liblzma/common/index.c b/src/liblzma/common/index.c |
| 25 | +index a41e8f3..f1629b1 100644 |
| 26 | +--- a/src/liblzma/common/index.c |
| 27 | ++++ b/src/liblzma/common/index.c |
| 28 | +@@ -433,6 +433,26 @@ lzma_index_prealloc(lzma_index *i, lzma_vli records) |
| 29 | + if (records > PREALLOC_MAX) |
| 30 | + records = PREALLOC_MAX; |
| 31 | + |
| 32 | ++ // If index_decoder.c calls us with records == 0, it's decoding |
| 33 | ++ // an Index that has no Records. In that case the decoder won't call |
| 34 | ++ // lzma_index_append() at all, and i->prealloc isn't used during |
| 35 | ++ // the Index decoding either. |
| 36 | ++ // |
| 37 | ++ // Normally the first lzma_index_append() call from the Index decoder |
| 38 | ++ // would reset i->prealloc to INDEX_GROUP_SIZE. With no Records, |
| 39 | ++ // lzma_index_append() isn't called and the resetting of prealloc |
| 40 | ++ // won't occur either. Thus, if records == 0, use the default value |
| 41 | ++ // INDEX_GROUP_SIZE instead. |
| 42 | ++ // |
| 43 | ++ // NOTE: lzma_index_append() assumes i->prealloc > 0. liblzma <= 5.8.2 |
| 44 | ++ // didn't have this check and could set i->prealloc = 0, which would |
| 45 | ++ // result in a buffer overflow if the application called |
| 46 | ++ // lzma_index_append() after decoding an empty Index. Appending |
| 47 | ++ // Records after decoding an Index is a rare thing to do, but |
| 48 | ++ // it is supposed to work. |
| 49 | ++ if (records == 0) |
| 50 | ++ records = INDEX_GROUP_SIZE; |
| 51 | ++ |
| 52 | + i->prealloc = (size_t)(records); |
| 53 | + return; |
| 54 | + } |
| 55 | +@@ -675,6 +695,7 @@ lzma_index_append(lzma_index *i, const lzma_allocator *allocator, |
| 56 | + ++g->last; |
| 57 | + } else { |
| 58 | + // We need to allocate a new group. |
| 59 | ++ assert(i->prealloc > 0); |
| 60 | + g = lzma_alloc(sizeof(index_group) |
| 61 | + + i->prealloc * sizeof(index_record), |
| 62 | + allocator); |
| 63 | +-- |
| 64 | +2.45.4 |
| 65 | + |
0 commit comments