Skip to content

Commit

Permalink
Avoid pre-decrement of pointer in big-endian CRC calculation.
Browse files Browse the repository at this point in the history
There was a small optimization for PowerPCs to pre-increment a
pointer when accessing a word, instead of post-incrementing. This
required prefacing the loop with a decrement of the pointer,
possibly pointing before the object passed. This is not compliant
with the C standard, for which decrementing a pointer before its
allocated memory is undefined. When tested on a modern PowerPC
with a modern compiler, the optimization no longer has any effect.
Due to all that, and per the recommendation of a security audit of
the zlib code by Trail of Bits and TrustInSoft, in support of the
Mozilla Foundation, this "optimization" was removed, in order to
avoid the possibility of undefined behavior.
  • Loading branch information
madler committed Sep 29, 2016
1 parent 6a04314 commit d1d5774
Showing 1 changed file with 1 addition and 3 deletions.
4 changes: 1 addition & 3 deletions crc32.c
Original file line number Diff line number Diff line change
Expand Up @@ -278,7 +278,7 @@ local unsigned long crc32_little(crc, buf, len)
}

/* ========================================================================= */
#define DOBIG4 c ^= *++buf4; \
#define DOBIG4 c ^= *buf4++; \
c = crc_table[4][c & 0xff] ^ crc_table[5][(c >> 8) & 0xff] ^ \
crc_table[6][(c >> 16) & 0xff] ^ crc_table[7][c >> 24]
#define DOBIG32 DOBIG4; DOBIG4; DOBIG4; DOBIG4; DOBIG4; DOBIG4; DOBIG4; DOBIG4
Expand All @@ -300,7 +300,6 @@ local unsigned long crc32_big(crc, buf, len)
}

buf4 = (const z_crc_t FAR *)(const void FAR *)buf;
buf4--;
while (len >= 32) {
DOBIG32;
len -= 32;
Expand All @@ -309,7 +308,6 @@ local unsigned long crc32_big(crc, buf, len)
DOBIG4;
len -= 4;
}
buf4++;
buf = (const unsigned char FAR *)buf4;

if (len) do {
Expand Down

2 comments on commit d1d5774

@chandanbn
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is CVE-2016-9843.

@yazeshi
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do you have the CVE-2016-9843's poc,if you have it, can you mail it to my emai——yazeshi@yeah.net

Please sign in to comment.