From 2b975a449c17268f943403176a7609079b7af084 Mon Sep 17 00:00:00 2001
From: David Oberhollenzer <david.oberhollenzer@sigma-star.at>
Date: Sat, 4 May 2019 15:32:52 +0200
Subject: Remove compressor internal buffers

Pass in an external destination buffer + size and allow for propper
bounds checking (especially when unpacking).

Signed-off-by: David Oberhollenzer <david.oberhollenzer@sigma-star.at>
---
 lib/comp/lzma.c | 34 ++++++++++++----------------------
 lib/comp/zlib.c | 13 ++++++-------
 2 files changed, 18 insertions(+), 29 deletions(-)

(limited to 'lib/comp')

diff --git a/lib/comp/lzma.c b/lib/comp/lzma.c
index fd2a6c7..3169c33 100644
--- a/lib/comp/lzma.c
+++ b/lib/comp/lzma.c
@@ -9,12 +9,11 @@
 
 typedef struct {
 	compressor_t base;
-
 	size_t block_size;
-	uint8_t buffer[];
 } lzma_compressor_t;
 
-static ssize_t lzma_comp_block(compressor_t *base, uint8_t *block, size_t size)
+static ssize_t lzma_comp_block(compressor_t *base, const uint8_t *in,
+			       size_t size, uint8_t *out, size_t outsize)
 {
 	lzma_compressor_t *lzma = (lzma_compressor_t *)base;
 	lzma_filter filters[5];
@@ -36,16 +35,10 @@ static ssize_t lzma_comp_block(compressor_t *base, uint8_t *block, size_t size)
 	filters[1].options = NULL;
 
 	ret = lzma_stream_buffer_encode(filters, LZMA_CHECK_CRC32, NULL,
-					block, size, lzma->buffer,
-					&written, lzma->block_size);
-
-	if (ret == LZMA_OK) {
-		if (written >= size)
-			return 0;
+					in, size, out, &written, outsize);
 
-		memcpy(block, lzma->buffer, size);
-		return written;
-	}
+	if (ret == LZMA_OK)
+		return (written >= size) ? 0 : written;
 
 	if (ret != LZMA_BUF_ERROR) {
 		fputs("lzma block compress failed\n", stderr);
@@ -55,24 +48,21 @@ static ssize_t lzma_comp_block(compressor_t *base, uint8_t *block, size_t size)
 	return 0;
 }
 
-static ssize_t lzma_uncomp_block(compressor_t *base, uint8_t *block,
-				 size_t size)
+static ssize_t lzma_uncomp_block(compressor_t *base, const uint8_t *in,
+				 size_t size, uint8_t *out, size_t outsize)
 {
-	lzma_compressor_t *lzma = (lzma_compressor_t *)base;
 	uint64_t memlimit = 32 * 1024 * 1024;
 	size_t dest_pos = 0;
 	size_t src_pos = 0;
 	lzma_ret ret;
+	(void)base;
 
 	ret = lzma_stream_buffer_decode(&memlimit, 0, NULL,
-					block, &src_pos, size,
-					lzma->buffer, &dest_pos,
-					lzma->block_size);
+					in, &src_pos, size,
+					out, &dest_pos, outsize);
 
-	if (ret == LZMA_OK && size == src_pos) {
-		memcpy(block, lzma->buffer, dest_pos);
+	if (ret == LZMA_OK && size == src_pos)
 		return (ssize_t)dest_pos;
-	}
 
 	fputs("lzma block extract failed\n", stderr);
 	return -1;
@@ -85,7 +75,7 @@ static void lzma_destroy(compressor_t *base)
 
 compressor_t *create_lzma_compressor(bool compress, size_t block_size)
 {
-	lzma_compressor_t *lzma = calloc(1, sizeof(*lzma) + block_size);
+	lzma_compressor_t *lzma = calloc(1, sizeof(*lzma));
 	compressor_t *base = (compressor_t *)lzma;
 
 	if (lzma == NULL) {
diff --git a/lib/comp/zlib.c b/lib/comp/zlib.c
index d3bfe70..f151132 100644
--- a/lib/comp/zlib.c
+++ b/lib/comp/zlib.c
@@ -14,7 +14,6 @@ typedef struct {
 	bool compress;
 
 	size_t block_size;
-	uint8_t buffer[];
 } zlib_compressor_t;
 
 static void zlib_destroy(compressor_t *base)
@@ -30,7 +29,8 @@ static void zlib_destroy(compressor_t *base)
 	free(zlib);
 }
 
-static ssize_t zlib_do_block(compressor_t *base, uint8_t *block, size_t size)
+static ssize_t zlib_do_block(compressor_t *base, const uint8_t *in,
+			     size_t size, uint8_t *out, size_t outsize)
 {
 	zlib_compressor_t *zlib = (zlib_compressor_t *)base;
 	size_t written;
@@ -47,10 +47,10 @@ static ssize_t zlib_do_block(compressor_t *base, uint8_t *block, size_t size)
 		return -1;
 	}
 
-	zlib->strm.next_in = (void *)block;
+	zlib->strm.next_in = (void *)in;
 	zlib->strm.avail_in = size;
-	zlib->strm.next_out = zlib->buffer;
-	zlib->strm.avail_out = zlib->block_size;
+	zlib->strm.next_out = out;
+	zlib->strm.avail_out = outsize;
 
 	if (zlib->compress) {
 		ret = deflate(&zlib->strm, Z_FINISH);
@@ -64,7 +64,6 @@ static ssize_t zlib_do_block(compressor_t *base, uint8_t *block, size_t size)
 		if (zlib->compress && written >= size)
 			return 0;
 
-		memcpy(block, zlib->buffer, written);
 		return (ssize_t)written;
 	}
 
@@ -78,7 +77,7 @@ static ssize_t zlib_do_block(compressor_t *base, uint8_t *block, size_t size)
 
 compressor_t *create_zlib_compressor(bool compress, size_t block_size)
 {
-	zlib_compressor_t *zlib = calloc(1, sizeof(*zlib) + block_size);
+	zlib_compressor_t *zlib = calloc(1, sizeof(*zlib));
 	compressor_t *base = (compressor_t *)zlib;
 	int ret;
 
-- 
cgit v1.2.3