initramfs: handle unrecognised decompressor when unpacking
commit46cdf2a8b9d5b105f609469e0caf9dc2336d7e22
authorPhillip Lougher <phillip@lougher.demon.co.uk>
Fri, 23 Apr 2010 17:18:11 +0000 (23 13:18 -0400)
committerGreg Kroah-Hartman <gregkh@suse.de>
Wed, 12 May 2010 21:57:10 +0000 (12 14:57 -0700)
treed7eb6ed78b680b27d1a97fcb77e1989b5af4fe64
parentdc1429f8aef9acfa88920311d045c54bc97b062f
initramfs: handle unrecognised decompressor when unpacking

commit df37bd156dcb4f5441beaf5bde444adac974e9a0 upstream.

The unpack routine fails to handle the decompress_method() returning
unrecognised decompressor (compress_name == NULL).  This results in the
routine looping eventually oopsing on an out of bounds memory access.

Note this bug is usually hidden, only triggering on trailing junk after
one or more correct compressed blocks.  The case of the compressed archive
being complete junk is (by accident?) caught by the if (state != Reset)
check because state is initialised to Start, but not updated due to the
decompressor not having been called.  Obviously if the junk is trailing a
correctly decompressed buffer, state == Reset from the previous call to
the decompressor.

Signed-off-by: Phillip Lougher <phillip@lougher.demon.co.uk>
Reported-by: Aaro Koskinen <aaro.koskinen@iki.fi>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
init/initramfs.c