Skip to content
  • Phillip Lougher's avatar
    squashfs: fix use of uninitialised variable in zlib & xz decompressors · 3689456b
    Phillip Lougher authored
    
    
    Fix potential use of uninitialised variable caused by recent
    decompressor code optimisations.
    
    In zlib_uncompress (zlib_wrapper.c) we have
    
    	int zlib_err, zlib_init = 0;
    	...
    	do {
    		...
    			if (avail == 0) {
    				offset = 0;
    				put_bh(bh[k++]);
    				continue;
    			}
    		...
    		zlib_err = zlib_inflate(stream, Z_SYNC_FLUSH);
    		...
    	} while (zlib_err == Z_OK);
    
    If continue is executed (avail == 0) then the while condition will be
    evaluated testing zlib_err, which is uninitialised first time around the
    loop.
    
    Fix this by getting rid of the 'if (avail == 0)' condition test, this
    edge condition should not be being handled in the decompressor code, and
    instead handle it generically in the caller code.
    
    Similarly for xz_wrapper.c.
    
    Incidentally, on most architectures (bar Mips and Parisc), no
    uninitialised variable warning is generated by gcc, this is because the
    while condition test on continue is optimised out and not performed
    (when executing continue zlib_err has not been changed since entering
    the loop, and logically if the while condition was true previously, then
    it's still true).
    
    Signed-off-by: default avatarPhillip Lougher <phillip@lougher.demon.co.uk>
    Reported-by: default avatarJesper Juhl <jj@chaosbits.net>
    Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
    Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
    3689456b