#944223 lz4 SIGSEGV in LZ4_decompress_generic

Package:
lz4
Source:
lz4
Description:
Fast LZ compression algorithm library - tool
Submitter:
Mihail Safronov
Date:
2019-11-13 04:57:03 UTC
Severity:
important
#944223#5
Date:
2019-11-06 10:19:01 UTC
From:
To:
I got SIGSEGV with lz4 (
http://deb.debian.org/debian/pool/main/l/lz4/lz4_1.8.3.orig.tar.gz) in
Debian Buster, when trying to read a corrupted stream
No null ptr check of source in LZ4_decompress_generic

Description of problem:

No null ptr check of source in  LZ4_decompress_generic

(gdb) bt
#0  0x00007ffff74ede70 in LZ4_decompress_generic (source=0x0,
    dest=0x631000028800 "press.foo.bar.6057 1
349830001\ncompress.foo.bar.6058 1 349830001\ncompress.foo.bar.6059 1
349830001\ncompress.foo.bar.6060 1 349830001\ncompress.foo.bar.6061 1
349830001\ncompress.foo.bar.6062 1 349830001"..., inputSize=1253,
outputSize=65536, endOnInput=1, partialDecoding=0, targetOutputSize=0,
dict=0,
    lowPrefix=0x631000028800 "press.foo.bar.6057 1
349830001\ncompress.foo.bar.6058 1 349830001\ncompress.foo.bar.6059 1
349830001\ncompress.foo.bar.6060 1 349830001\ncompress.foo.bar.6061 1
349830001\ncompress.foo.bar.6062 1 349830001"..., dictStart=0x0,
dictSize=0) at lz4.c:1157
#1  LZ4_decompress_safe (source=0x0,
    dest=0x631000028800 "press.foo.bar.6057 1
349830001\ncompress.foo.bar.6058 1 349830001\ncompress.foo.bar.6059 1
349830001\ncompress.foo.bar.6060 1 349830001\ncompress.foo.bar.6061 1
349830001\ncompress.foo.bar.6062 1 349830001"..., compressedSize=1253,
maxDecompressedSize=65536) at lz4.c:1290
#2  0x00007ffff7560631 in LZ4F_decompress_safe (source=0x0,
    dest=0x631000028800 "press.foo.bar.6057 1
349830001\ncompress.foo.bar.6058 1 349830001\ncompress.foo.bar.6059 1
349830001\ncompress.foo.bar.6060 1 349830001\ncompress.foo.bar.6061 1
349830001\ncompress.foo.bar.6062 1 349830001"..., compressedSize=1253,
maxDecompressedSize=65536,
    dictStart=0x631000028800 "press.foo.bar.6057 1
349830001\ncompress.foo.bar.6058 1 349830001\ncompress.foo.bar.6059 1
349830001\ncompress.foo.bar.6060 1 349830001\ncompress.foo.bar.6061 1
349830001\ncompress.foo.bar.6062 1 349830001"..., dictSize=0) at
lz4frame.c:957
#3  0x00007ffff755595b in LZ4F_decompress
(decompressionContext=0x61100000ff40, dstBuffer=0x7fffe8bdd82c,
dstSizePtr=0x7ffff0cf96e0, srcBuffer=0x62d000014400,
srcSizePtr=0x7ffff0cf96c0,
    decompressOptionsPtr=0x7ffff0cf8120) at lz4frame.c:1294


Version-Release number of selected component (if applicable):

In lz4 from HEAD bug was fixed
https://github.com/lz4/lz4/blob/master/lib/lz4.c#L1668
#944223#10
Date:
2019-11-07 14:15:43 UTC
From:
To:
Problem is more complex. When receive incomplete stream, decompression
context need to be reset with LZ4F_resetDecompressionContext (added in
lz4 1.8.0).

I add simple port (this is for lz4 1.7 in CentOS 7)

void LZ4F_resetDecompressionContext(LZ4F_dctx* dctx)
{
    dctx->dStage = dstage_getHeader;
    dctx->dict = NULL;
    dctx->dictSize = 0;
}

And with first patch problem was solved.
#944223#15
Date:
2019-11-08 06:56:24 UTC
From:
To:
Patches for Debian Stretch

чт, 7 нояб. 2019 г. в 19:15, Mihail Safronov <msaf1980@gmail.com>:
#944223#20
Date:
2019-11-08 08:44:59 UTC
From:
To:
Patch for Debain Buster

пт, 8 нояб. 2019 г. в 11:56, Mihail Safronov <msaf1980@gmail.com>:
#944223#25
Date:
2019-11-13 04:53:13 UTC
From:
To:
Hi,

Thanks for your work and patch is looking good to me.
I will apply this  to buster.

Best regards,
  Nobuhiro

2019年11月8日(金) 17:48 Mihail Safronov <msaf1980@gmail.com>: