Lncvrt/grub
1
0 Fork 0
mirror of https://git.savannah.gnu.org/git/grub.git synced 2026-10-20 22:48:22 +00:00
Code Issues Packages Projects Releases Wiki Activity

Revert "lzma: Make sure we don't dereference past array"

Browse Source 
Commit 40e261b89b (lib/LzmaEnc: Validate "len" before subtracting)
ensures that the variable len is at least 2. As a result, GetLenToPosState(len)
never returns a value greater than or equal to kNumLenToPosStates,
making the changes introduced in the commit 16c0dbf4bc (lzma: Make
sure we don't dereference past array) unreachable and no longer necessary.

This reverts commit 16c0dbf4bc (lzma: Make sure we don't dereference past array).

Fixes: CID 481982

Signed-off-by: Lidong Chen <lidong.chen@oracle.com>
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
This commit is contained in:
Lidong Chen authored and Daniel Kiper committed 2025-06-26 18:05:08 +02:00
1 parent 2539ede82a
commit 2f2ed28d5a
1 file changed
+2 -8
Download Patch File Download Diff File Expand all files Collapse all files
grub-core/lib/LzmaEnc.c
+2 -8
View File
@@ -1877,7 +1877,7 @@ static SRes LzmaEnc_CodeOneBlock(CLzmaEnc *p, Bool useLimits, UInt32 maxPackSize
}
else
{
UInt32 posSlot, lenToPosState;
UInt32 posSlot;
RangeEnc_EncodeBit(&p->rc, &p->isRep[p->state], 0);
p->state = kMatchNextStates[p->state];
if (len < LZMA_MATCH_LEN_MIN)
@@ -1888,13 +1888,7 @@ static SRes LzmaEnc_CodeOneBlock(CLzmaEnc *p, Bool useLimits, UInt32 maxPackSize
LenEnc_Encode2(&p->lenEnc, &p->rc, len - LZMA_MATCH_LEN_MIN, posState, !p->fastMode, p->ProbPrices);
pos -= LZMA_NUM_REPS;
GetPosSlot(pos, posSlot);
lenToPosState = GetLenToPosState(len);
if (lenToPosState >= kNumLenToPosStates)
{
p->result = SZ_ERROR_DATA;
return CheckErrors(p);
}
RcTree_Encode(&p->rc, p->posSlotEncoder[lenToPosState], kNumPosSlotBits, posSlot);
RcTree_Encode(&p->rc, p->posSlotEncoder[GetLenToPosState(len)], kNumPosSlotBits, posSlot);
if (posSlot >= kStartPosModelIndex)
{