Skip to content

Commit

Permalink
initramfs: handle unrecognised decompressor when unpacking
Browse files Browse the repository at this point in the history
The unpack routine fails to handle the decompress_method() returning
unrecognised decompressor (compress_name == NULL).  This results in the
routine looping eventually oopsing on an out of bounds memory access.

Note this bug is usually hidden, only triggering on trailing junk after
one or more correct compressed blocks.  The case of the compressed archive
being complete junk is (by accident?) caught by the if (state != Reset)
check because state is initialised to Start, but not updated due to the
decompressor not having been called.  Obviously if the junk is trailing a
correctly decompressed buffer, state == Reset from the previous call to
the decompressor.

Signed-off-by: Phillip Lougher <[email protected]>
Reported-by: Aaro Koskinen <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>
  • Loading branch information
Phillip Lougher authored and torvalds committed Apr 24, 2010
1 parent 22eccdd commit df37bd1
Showing 1 changed file with 2 additions and 1 deletion.
3 changes: 2 additions & 1 deletion init/initramfs.c
Original file line number Diff line number Diff line change
Expand Up @@ -457,7 +457,8 @@ static char * __init unpack_to_rootfs(char *buf, unsigned len)
compress_name);
message = msg_buf;
}
}
} else
error("junk in compressed archive");
if (state != Reset)
error("junk in compressed archive");
this_header = saved_offset + my_inptr;
Expand Down

0 comments on commit df37bd1

Please sign in to comment.