Skip to contentSkip to conversation

initramfs: handle unrecognised decompressor when unpacking

PATCH New Phillip Lougher 1 participant 1 message Apr 23, 2010 VFS

lore
Share & tools
lore
#0 lore raw

PATCH 1/1 initramfs: handle unrecognised decompressor when unpacking

The unpack routine fails to handle the decompress_method() returning unrecognised decompressor (compress_name == NULL). This results in the routine looping eventually oopsing on an out of bounds memory access.

Note this bug is usually hidden, only triggering on trailing junk after one or more correct compressed blocks. The case of the compressed archive being complete junk
is (by accident?) caught by the if (state != Reset) check because state is initialised to Start, but not updated due to
the decompressor not having been called. Obviously if the junk
is trailing a correctly decompressed buffer, state == Reset from the previous call to the decompressor.

---
 init/initramfs.c |    3 ++-
 1 files changed, 2 insertions(+), 1 deletions(-)
init/initramfs.c +2 -1
index 37d3859..4b9c202 100644
@@ -457,7 +457,8 @@ static char * __init unpack_to_rootfs(char *buf, unsigned len)
 					 compress_name);
 				message = msg_buf;
 			}
-		}
+		} else
+			error("junk in compressed archive");
 		if (state != Reset)
 			error("junk in compressed archive");
 		this_header = saved_offset + my_inptr;
Signature · 1 line
1.6.3.3