* [PATCH] MdeModulePkg: Fix BrotliCustomDecompressLib potential issue
@ 2017-04-07 6:52 Song, BinX
2017-04-12 6:31 ` Gao, Liming
0 siblings, 1 reply; 2+ messages in thread
From: Song, BinX @ 2017-04-07 6:52 UTC (permalink / raw)
To: edk2-devel@lists.01.org; +Cc: Gao, Liming
- Fix BrotliCustomDecompressLib potential issue
Cc: Liming Gao <liming.gao@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Bell Song <binx.song@intel.com>
---
.../Library/BrotliCustomDecompressLib/BrotliDecompress.c | 1 +
MdeModulePkg/Library/BrotliCustomDecompressLib/dec/decode.c | 12 ++++++++----
2 files changed, 9 insertions(+), 4 deletions(-)
diff --git a/MdeModulePkg/Library/BrotliCustomDecompressLib/BrotliDecompress.c b/MdeModulePkg/Library/BrotliCustomDecompressLib/BrotliDecompress.c
index 2c2648a..a303921 100644
--- a/MdeModulePkg/Library/BrotliCustomDecompressLib/BrotliDecompress.c
+++ b/MdeModulePkg/Library/BrotliCustomDecompressLib/BrotliDecompress.c
@@ -126,6 +126,7 @@ BrotliDecompress (
BrotliState * BroState;
VOID * Temp;
+ TotalOut = 0;
AvailableOut = FILE_BUFFER_SIZE;
Result = BROTLI_RESULT_ERROR;
BroState = BrotliCreateState(BrAlloc, BrFree, BuffInfo);
diff --git a/MdeModulePkg/Library/BrotliCustomDecompressLib/dec/decode.c b/MdeModulePkg/Library/BrotliCustomDecompressLib/dec/decode.c
index 1ebab3c..c49fab9 100644
--- a/MdeModulePkg/Library/BrotliCustomDecompressLib/dec/decode.c
+++ b/MdeModulePkg/Library/BrotliCustomDecompressLib/dec/decode.c
@@ -802,6 +802,7 @@ static BROTLI_INLINE uint32_t ReadBlockLength(const HuffmanCode* table,
uint32_t code;
uint32_t nbits;
code = ReadSymbol(table, br);
+ if (code >= BROTLI_NUM_BLOCK_LEN_SYMBOLS) code = BROTLI_NUM_BLOCK_LEN_SYMBOLS - 1;
nbits = kBlockLengthPrefixCode[code].nbits; /* nbits == 2..24 */
return kBlockLengthPrefixCode[code].offset + BrotliReadBits(br, nbits);
}
@@ -872,13 +873,13 @@ static BROTLI_NOINLINE void InverseMoveToFrontTransform(
for (i = 0; i < v_len; ++i) {
int index = v[i];
uint8_t value = mtf[index];
- upper_bound |= v[i];
+ upper_bound |= (uint32_t)v[i];
v[i] = value;
mtf[-1] = value;
- do {
+ while (index > 0) {
index--;
mtf[index + 1] = mtf[index];
- } while (index >= 0);
+ }
}
/* Remember amount of elements to be reinitialized. */
state->mtf_upper_bound = upper_bound;
@@ -1498,6 +1499,7 @@ static BROTLI_INLINE BROTLI_BOOL ReadCommandInternal(
return BROTLI_FALSE;
}
}
+ if (cmd_code >= BROTLI_NUM_COMMAND_SYMBOLS) cmd_code = BROTLI_NUM_COMMAND_SYMBOLS - 1;
v = kCmdLut[cmd_code];
s->distance_code = v.distance_code;
s->distance_context = v.context;
@@ -2209,7 +2211,9 @@ BrotliDecoderResult BrotliDecoderDecompressStream(
}
s->max_distance = s->max_backward_distance;
if (s->state == BROTLI_STATE_COMMAND_POST_WRITE_1) {
- memcpy(s->ringbuffer, s->ringbuffer_end, (size_t)s->pos);
+ if (s->ringbuffer != 0) {
+ memcpy(s->ringbuffer, s->ringbuffer_end, (size_t)s->pos);
+ }
if (s->meta_block_remaining_len == 0) {
/* Next metablock, if any */
s->state = BROTLI_STATE_METABLOCK_DONE;
--
2.10.2.windows.1
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH] MdeModulePkg: Fix BrotliCustomDecompressLib potential issue
2017-04-07 6:52 [PATCH] MdeModulePkg: Fix BrotliCustomDecompressLib potential issue Song, BinX
@ 2017-04-12 6:31 ` Gao, Liming
0 siblings, 0 replies; 2+ messages in thread
From: Gao, Liming @ 2017-04-12 6:31 UTC (permalink / raw)
To: Song, BinX, edk2-devel@lists.01.org
Reviewed-by: Liming Gao <liming.gao@intel.com>
>-----Original Message-----
>From: Song, BinX
>Sent: Friday, April 07, 2017 2:52 PM
>To: edk2-devel@lists.01.org
>Cc: Gao, Liming <liming.gao@intel.com>
>Subject: [PATCH] MdeModulePkg: Fix BrotliCustomDecompressLib potential
>issue
>
>- Fix BrotliCustomDecompressLib potential issue
>
>Cc: Liming Gao <liming.gao@intel.com>
>Contributed-under: TianoCore Contribution Agreement 1.0
>Signed-off-by: Bell Song <binx.song@intel.com>
>---
> .../Library/BrotliCustomDecompressLib/BrotliDecompress.c | 1 +
> MdeModulePkg/Library/BrotliCustomDecompressLib/dec/decode.c | 12
>++++++++----
> 2 files changed, 9 insertions(+), 4 deletions(-)
>
>diff --git
>a/MdeModulePkg/Library/BrotliCustomDecompressLib/BrotliDecompress.c
>b/MdeModulePkg/Library/BrotliCustomDecompressLib/BrotliDecompress.c
>index 2c2648a..a303921 100644
>---
>a/MdeModulePkg/Library/BrotliCustomDecompressLib/BrotliDecompress.c
>+++
>b/MdeModulePkg/Library/BrotliCustomDecompressLib/BrotliDecompress.c
>@@ -126,6 +126,7 @@ BrotliDecompress (
> BrotliState * BroState;
> VOID * Temp;
>
>+ TotalOut = 0;
> AvailableOut = FILE_BUFFER_SIZE;
> Result = BROTLI_RESULT_ERROR;
> BroState = BrotliCreateState(BrAlloc, BrFree, BuffInfo);
>diff --git
>a/MdeModulePkg/Library/BrotliCustomDecompressLib/dec/decode.c
>b/MdeModulePkg/Library/BrotliCustomDecompressLib/dec/decode.c
>index 1ebab3c..c49fab9 100644
>--- a/MdeModulePkg/Library/BrotliCustomDecompressLib/dec/decode.c
>+++ b/MdeModulePkg/Library/BrotliCustomDecompressLib/dec/decode.c
>@@ -802,6 +802,7 @@ static BROTLI_INLINE uint32_t ReadBlockLength(const
>HuffmanCode* table,
> uint32_t code;
> uint32_t nbits;
> code = ReadSymbol(table, br);
>+ if (code >= BROTLI_NUM_BLOCK_LEN_SYMBOLS) code =
>BROTLI_NUM_BLOCK_LEN_SYMBOLS - 1;
> nbits = kBlockLengthPrefixCode[code].nbits; /* nbits == 2..24 */
> return kBlockLengthPrefixCode[code].offset + BrotliReadBits(br, nbits);
> }
>@@ -872,13 +873,13 @@ static BROTLI_NOINLINE void
>InverseMoveToFrontTransform(
> for (i = 0; i < v_len; ++i) {
> int index = v[i];
> uint8_t value = mtf[index];
>- upper_bound |= v[i];
>+ upper_bound |= (uint32_t)v[i];
> v[i] = value;
> mtf[-1] = value;
>- do {
>+ while (index > 0) {
> index--;
> mtf[index + 1] = mtf[index];
>- } while (index >= 0);
>+ }
> }
> /* Remember amount of elements to be reinitialized. */
> state->mtf_upper_bound = upper_bound;
>@@ -1498,6 +1499,7 @@ static BROTLI_INLINE BROTLI_BOOL
>ReadCommandInternal(
> return BROTLI_FALSE;
> }
> }
>+ if (cmd_code >= BROTLI_NUM_COMMAND_SYMBOLS) cmd_code =
>BROTLI_NUM_COMMAND_SYMBOLS - 1;
> v = kCmdLut[cmd_code];
> s->distance_code = v.distance_code;
> s->distance_context = v.context;
>@@ -2209,7 +2211,9 @@ BrotliDecoderResult
>BrotliDecoderDecompressStream(
> }
> s->max_distance = s->max_backward_distance;
> if (s->state == BROTLI_STATE_COMMAND_POST_WRITE_1) {
>- memcpy(s->ringbuffer, s->ringbuffer_end, (size_t)s->pos);
>+ if (s->ringbuffer != 0) {
>+ memcpy(s->ringbuffer, s->ringbuffer_end, (size_t)s->pos);
>+ }
> if (s->meta_block_remaining_len == 0) {
> /* Next metablock, if any */
> s->state = BROTLI_STATE_METABLOCK_DONE;
>--
>2.10.2.windows.1
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2017-04-12 6:31 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2017-04-07 6:52 [PATCH] MdeModulePkg: Fix BrotliCustomDecompressLib potential issue Song, BinX
2017-04-12 6:31 ` Gao, Liming
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox