Emulation/switch-coreboot
1
0
Fork 0
mirror of https://github.com/fail0verflow/switch-coreboot.git synced 2025-05-04 01:39:18 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

UPSTREAM: libpayload: lzma: Allocate scratchpad on the heap

Browse source 
Allocating a 15980-byte scratchpad on the stack when your default stack
size is set to 16KB is really not a great idea. We're regularly
overflowing into the end of our heap when using LZMA in libpayload, and
just happen not to notice it because the heap rarely gets filled up all
the way. Of course, since we always *have* a heap in libpayload, the
much saner solution is to just use it directly to allocate the
scratchpad rather than accidentally grow backwards into it anyway.

BUG=None
BRANCH=None
TEST=None

Signed-off-by: Julius Werner <jwerner@chromium.org>
Reviewed-on: https://review.coreboot.org/16089

Reviewed-by: Aaron Durbin <adurbin@chromium.org>

Change-Id: Ibe4f02057a32bd156a126302178fa6fcab637d2c
Reviewed-on: https://chromium-review.googlesource.com/368287
Commit-Ready: Furquan Shaikh <furquan@chromium.org>
Tested-by: Furquan Shaikh <furquan@chromium.org>
Reviewed-by: Aaron Durbin <adurbin@chromium.org>
This commit is contained in:
Julius Werner 2016-08-05 20:43:47 -07:00 • committed by chrome-bot
parent c0515aff63
commit d7c15e636c
1 changed files with 7 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
payloads/libpayload/liblzma/lzma.c
View file

@ -10,6 +10,7 @@
*/
#include <lzma.h>
#include <stdlib.h>
#include <stdio.h>
#include <string.h>
#include "lzmadecode.c"
@ -25,7 +26,7 @@ unsigned long ulzman(const unsigned char *src, unsigned long srcn,
int res;
CLzmaDecoderState state;
SizeT mallocneeds;
unsigned char scratchpad[15980];
unsigned char *scratchpad;
memcpy(properties, src, LZMA_PROPERTIES_SIZE);
memcpy(&outSize, src + LZMA_PROPERTIES_SIZE, sizeof(outSize));
@ -37,13 +38,16 @@ unsigned long ulzman(const unsigned char *src, unsigned long srcn,
return 0;
}
mallocneeds = (LzmaGetNumProbs(&state.Properties) * sizeof(CProb));
if (mallocneeds > 15980) {
printf("lzma: Decoder scratchpad too small!\n");
scratchpad = malloc(mallocneeds);
if (!scratchpad) {
printf("lzma: Cannot allocate %u bytes for scratchpad!\n",
mallocneeds);
return 0;
}
state.Probs = (CProb *)scratchpad;
res = LzmaDecode(&state, src + data_offset, srcn - data_offset,
&inProcessed, dst, outSize, &outProcessed);
free(scratchpad);
if (res != 0) {
printf("lzma: Decoding error = %d\n", res);
return 0;