From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from gnu.wildebeest.org (gnu.wildebeest.org [45.83.234.184]) by sourceware.org (Postfix) with ESMTPS id 12ACB3858D1E for ; Thu, 23 Nov 2023 23:32:15 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org 12ACB3858D1E Authentication-Results: sourceware.org; dmarc=none (p=none dis=none) header.from=klomp.org Authentication-Results: sourceware.org; spf=pass smtp.mailfrom=klomp.org ARC-Filter: OpenARC Filter v1.0.0 sourceware.org 12ACB3858D1E Authentication-Results: server2.sourceware.org; arc=none smtp.remote-ip=45.83.234.184 ARC-Seal: i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1700782336; cv=none; b=SxWl5paAuXTcN1LBxTgv2lc33p3qWjnlbiDGYurTPK/wf0ICkMaEx/q3nqTVWMzv10cLLLHukFqhnsEkF0GJCOJzUX8qkDlvzh3uxBxBgs3pU7ZAaYysB0jkjfbMYR5fgk0ttBJLzN/wmzJ2W7AnDB3mXconom26VcAKfitrDC0= ARC-Message-Signature: i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1700782336; c=relaxed/simple; bh=GUpPEZ/4Y22gPcuzPEvAzFFxIT1bPNOW8i3veV97jeA=; h=Date:From:To:Subject:Message-ID:MIME-Version; b=KfcIXp8fdrpJQ5q4kYxMGKJR8yJ2IoTHmnsvMKIBo+nhNp3Eg/tw4SEkdJwVEv0OfHEfPEWCWToRgFR01OpqMQWLSRhiK6mqZeRtgleEXwUl+LoSy+4jcVsvunpXY5PNFJLsN5GaDjev81hP5gi1mQti3GpUZ+1B9XHkDaVCV3s= ARC-Authentication-Results: i=1; server2.sourceware.org Received: by gnu.wildebeest.org (Postfix, from userid 1000) id E067B30291AB; Fri, 24 Nov 2023 00:32:13 +0100 (CET) Date: Fri, 24 Nov 2023 00:32:13 +0100 From: Mark Wielaard To: Aleksei Vetrov Cc: elfutils-devel@sourceware.org, kernel-team@android.com, maennich@google.com Subject: Re: [PATCH] libelf: check decompressed ZSTD size Message-ID: <20231123233213.GG5263@gnu.wildebeest.org> References: <20231123153147.537151-1-vvvvvv@google.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20231123153147.537151-1-vvvvvv@google.com> User-Agent: Mutt/1.5.21 (2010-09-15) X-Spam-Status: No, score=-3028.0 required=5.0 tests=BAYES_00,JMQ_SPF_NEUTRAL,KAM_DMARC_STATUS,SPF_HELO_NONE,SPF_PASS,TXREP,T_SCC_BODY_TEXT_LINE autolearn=no autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on server2.sourceware.org List-Id: Hi Aleksei, On Thu, Nov 23, 2023 at 03:31:47PM +0000, Aleksei Vetrov wrote: > Decompression functions like __libelf_decompress_zlib check that > decompressed data has the same size as it was declared in the header > (size_out argument). The same check is now added to > __libelf_decompress_zstd to make sure that the whole allocated buffer is > initialized. > > * libelf/elf_compress.c (__libelf_decompress_zstd): Use return value > of ZSTD_decompress to check that decompressed data size is the > same as size_out of the buffer that was allocated. Thanks, this makes sense. If the decompressed size isn't what was encoded in the Chdr then we could reduce the size of the d_buf/d_size, but that probably is not what the user expects. Flagging it as bad/inconsistent data makes sense. Especially since we do the same for zlib compressed data. Pushed, Mark