Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

squashfs: fix use of uninitialised variable in zlib & xz decompressors

Fix potential use of uninitialised variable caused by recent
decompressor code optimisations.

In zlib_uncompress (zlib_wrapper.c) we have

int zlib_err, zlib_init = 0;
...
do {
...
if (avail == 0) {
offset = 0;
put_bh(bh[k++]);
continue;
}
...
zlib_err = zlib_inflate(stream, Z_SYNC_FLUSH);
...
} while (zlib_err == Z_OK);

If continue is executed (avail == 0) then the while condition will be
evaluated testing zlib_err, which is uninitialised first time around the
loop.

Fix this by getting rid of the 'if (avail == 0)' condition test, this
edge condition should not be being handled in the decompressor code, and
instead handle it generically in the caller code.

Similarly for xz_wrapper.c.

Incidentally, on most architectures (bar Mips and Parisc), no
uninitialised variable warning is generated by gcc, this is because the
while condition test on continue is optimised out and not performed
(when executing continue zlib_err has not been changed since entering
the loop, and logically if the while condition was true previously, then
it's still true).

Signed-off-by: Phillip Lougher <phillip@lougher.demon.co.uk>
Reported-by: Jesper Juhl <jj@chaosbits.net>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

authored by

Phillip Lougher and committed by
Linus Torvalds
3689456b ac15ee69

+8 -12
+8
fs/squashfs/block.c
··· 63 63 *length = (unsigned char) bh->b_data[*offset] | 64 64 (unsigned char) bh->b_data[*offset + 1] << 8; 65 65 *offset += 2; 66 + 67 + if (*offset == msblk->devblksize) { 68 + put_bh(bh); 69 + bh = sb_bread(sb, ++(*cur_index)); 70 + if (bh == NULL) 71 + return NULL; 72 + *offset = 0; 73 + } 66 74 } 67 75 68 76 return bh;
-6
fs/squashfs/xz_wrapper.c
··· 95 95 if (!buffer_uptodate(bh[k])) 96 96 goto release_mutex; 97 97 98 - if (avail == 0) { 99 - offset = 0; 100 - put_bh(bh[k++]); 101 - continue; 102 - } 103 - 104 98 stream->buf.in = bh[k]->b_data + offset; 105 99 stream->buf.in_size = avail; 106 100 stream->buf.in_pos = 0;
-6
fs/squashfs/zlib_wrapper.c
··· 82 82 if (!buffer_uptodate(bh[k])) 83 83 goto release_mutex; 84 84 85 - if (avail == 0) { 86 - offset = 0; 87 - put_bh(bh[k++]); 88 - continue; 89 - } 90 - 91 85 stream->next_in = bh[k]->b_data + offset; 92 86 stream->avail_in = avail; 93 87 offset = 0;