Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit de885e3e authored by Qu Wenruo's avatar Qu Wenruo Committed by David Sterba
Browse files

btrfs: lzo: Harden inline lzo compressed extent decompression 



For inlined extent, we only have one segment, thus less things to check.
And further more, inlined extent always has the csum in its leaf header,
it's less probable to have corrupted data.

Anyway, still check header and segment header.

Signed-off-by: default avatarQu Wenruo <wqu@suse.com>
Reviewed-by: default avatarDavid Sterba <dsterba@suse.com>
Signed-off-by: default avatarDavid Sterba <dsterba@suse.com>
parent 314bfa47

fs/btrfs/lzo.c

+10 −1
Original line number Diff line number Diff line
@@ -430,15 +430,24 @@ static int lzo_decompress(struct list_head *ws, unsigned char *data_in, 
	struct workspace *workspace = list_entry(ws, struct workspace, list);

	size_t in_len;

	size_t out_len;

	size_t max_segment_len = lzo1x_worst_compress(PAGE_SIZE);

	int ret = 0;

	char *kaddr;

	unsigned long bytes;



	BUG_ON(srclen < LZO_LEN);

	if (srclen < LZO_LEN || srclen > max_segment_len + LZO_LEN * 2)

		return -EUCLEAN;



	in_len = read_compress_length(data_in);

	if (in_len != srclen)

		return -EUCLEAN;

	data_in += LZO_LEN;



	in_len = read_compress_length(data_in);

	if (in_len != srclen - LZO_LEN * 2) {

		ret = -EUCLEAN;

		goto out;

	}

	data_in += LZO_LEN;



	out_len = PAGE_SIZE;