File lz4-CVE-2021-3520.patch of Package lz4

Overview Repositories Revisions Requests Users Attributes Meta

File lz4-CVE-2021-3520.patch of Package lz4

Index: lz4-1.8.0/lib/lz4.c
===================================================================
--- lz4-1.8.0.orig/lib/lz4.c	2021-05-10 09:10:47.584795190 +0200
+++ lz4-1.8.0/lib/lz4.c	2021-05-10 09:34:24.376539502 +0200
@@ -1151,6 +1151,9 @@ FORCE_INLINE int LZ4_decompress_generic(
                  const size_t dictSize         /* note : = 0 if noDict */
                  )
 {
+    if ((source == NULL) || (outputSize < 0)) { return -1; }
+
+    {
     /* Local Variables */
     const BYTE* ip = (const BYTE*) source;
     const BYTE* const iend = ip + inputSize;
@@ -1161,7 +1164,7 @@ FORCE_INLINE int LZ4_decompress_generic(
     BYTE* oexit = op + targetOutputSize;
     const BYTE* const lowLimit = lowPrefix - dictSize;
 
-    const BYTE* const dictEnd = (const BYTE*)dictStart + dictSize;
+    const BYTE* const dictEnd = (dictStart == NULL) ? NULL : dictStart + dictSize;
     const unsigned dec32table[] = {0, 1, 2, 1, 4, 4, 4, 4};
     const int dec64table[] = {0, 0, 0, -1, 0, 1, 2, 3};
 
@@ -1295,6 +1298,7 @@ FORCE_INLINE int LZ4_decompress_generic(
     /* Overflow error detected */
 _output_error:
     return (int) (-(((const char*)ip)-source))-1;
+    }
 }

Places

File lz4-CVE-2021-3520.patch of Package lz4

Places