Re: [PATCH] Add missing bound checks for software 842 decompressor

2020-08-23 Thread Joan Bruguera
On 19.08.20 22:19, Kees Cook wrote: On Sun, Aug 16, 2020 at 02:33:41AM +0200, Joan Bruguera wrote: Any feedback? Hi! I just happened to see this email. I think this should likely be directed to the crypto (which also handled compress/decompress APIs) list and the original author... Additi

Re: [PATCH] Add missing bound checks for software 842 decompressor

2020-08-19 Thread Kees Cook
On Sun, Aug 16, 2020 at 02:33:41AM +0200, Joan Bruguera wrote: > Any feedback? Hi! I just happened to see this email. I think this should likely be directed to the crypto (which also handled compress/decompress APIs) list and the original author... Additional notes below... > - Joan > > On 05.

Re: [PATCH] Add missing bound checks for software 842 decompressor

2020-08-15 Thread Joan Bruguera
Any feedback? - Joan On 05.06.20 17:44, Joan Bruguera wrote: The software 842 decompressor receives, through the initial value of the 'olen' parameter, the capacity of the buffer pointed to by 'out'. If this capacity is insufficient to decode the compressed bitstream, -ENOSPC should be returned

[PATCH] Add missing bound checks for software 842 decompressor

2020-06-05 Thread Joan Bruguera
The software 842 decompressor receives, through the initial value of the 'olen' parameter, the capacity of the buffer pointed to by 'out'. If this capacity is insufficient to decode the compressed bitstream, -ENOSPC should be returned. However, the bounds checks are missing for index references (f