Skip to content
Commit 3dd342b0 authored by Tom Rini's avatar Tom Rini
Browse files

Revert "zlib: Port fix for CVE-2016-9841 to U-Boot"



In commit 340fdf13 ("zlib: Port fix for CVE-2016-9841 to U-Boot")
Michal brings in (correctly) the upstream fix for CVE-2016-9841.
However, when upstream was fixing this issue they also removed a
necessary optimization for some CPU classes as part of simplifying the
code. This in turn leads to boot failures on the platforms as they now
take too long to decompress images and so the watchdog sees the system
as stuck.

The long term fix here is as Christophe has posted, which is to restore
the optimization. Given the nearness of the release, what I do here is
very similar, result wise, but less so, code wise. This is a revert of
Michal's commit _except_ we only allow for post-increment in the code,
thus keeping the CVE resolved. For the next release this commit shall be
reverted and then Christophe's patch applied.

This largely reverts commit 340fdf13.

This also includes a one-line fixup from Christophe:
"It seems like when the optimisation was added by commit cd514aeb ("zlib:
Optimize decompression"), only the pre-increment implementation was available.

When POSTINC was added by commit e89516f0 ("zlib: split up to match
original source tree"), I guess it was not verified because POSTINC is #undef
by zlib.h."

Reported-by: default avatarChristophe Leroy <christophe.leroy@csgroup.eu>
Signed-off-by: default avatarTom Rini <trini@konsulko.com>
--
Cc: Christophe Leroy <christophe.leroy@csgroup.eu>
Cc: Michal Simek <michal.simek@amd.com>
parent 8937bb26
Loading
Loading
Loading
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment