IMPORT: uslz: reject codes from an empty distance table

gen_huffman_table() may be asked to accept a table with no symbol at
all (allow_no_symbols, the distance table). It used to return success
without initializing the table, but that storage aliases the persistent
header-detection buffer (hdr_detect), so gethuff() could walk header
bytes out of bounds. Make the two root entries terminal with an
out-of-range symbol so any code decoded against an empty table is
rejected.

Reported-by: Asjid Kalam <asjid.kalam@gmail.com>
(cherry picked from commit d97d31c2a7246d4faf53baa64b5f50aa895f7706)
Signed-off-by: Willy Tarreau <w@1wt.eu>
This is libslz upstream commit cab751dc4858a6c6510f5cebf7ad0dd5deaca244

diff --git a/src/uslz.c b/src/uslz.c
index 1e7a8f9e929e83681d34d6ca5afa6d6dba09eeb1..043a372386c5ba2eff77fe5dfc5954554ce5441a 100644 (file)
--- a/src/uslz.c
+++ b/src/uslz.c
@@ -107,8 +107,20 @@ static int gen_huffman_table(unsigned int symbols,
        for (i = 1; i < 16; i++)
                total_count += length_count[i];
 
-       if (total_count == 0)
-               return allow_no_symbols;
+       if (total_count == 0) {
+               if (!allow_no_symbols)
+                       return 0;
+               /* No symbol at all: the table is deliberately left empty by the
+                * caller, but its storage may alias the persistent header-detection
+                * buffer (see hdr_detect in struct uslz_stream). Make the two root
+                * entries terminal with an out-of-range symbol so that any code
+                * decoded against this table is rejected instead of making gethuff()
+                * walk stale/aliased memory.
+                */
+               table[0] = 0x7fff;
+               table[1] = 0x7fff;
+               return 1;
+       }
        else if (total_count == 1) {
                for (i = 0; i < symbols; i++) {
                        if (lengths[i] != 0) {