已关闭
fix: CVE-2026-27171 crc32_combine CPU consumption (zlib 1.2.x backport) [OpenHarmony-3.2-Release] #121
wu-jinpeng981212创建于 8月25日关闭于 16 天前
fix: CVE-2026-27171 crc32_combine CPU consumption (zlib 1.2.x backport) [OpenHarmony-3.2-Release] #121
已关闭
共 1 个文件变更+11-7
| @@ -100,7 +100,7 @@ | |||
| 100 | 100 | ||
| 101 | /* Local functions. */ | 101 | /* Local functions. */ |
| 102 | local z_crc_t multmodp OF((z_crc_t a, z_crc_t b)); | 102 | local z_crc_t multmodp OF((z_crc_t a, z_crc_t b)); |
| 103 | -local z_crc_t x2nmodp OF((z_off64_t n, unsigned k)); | 103 | +local uLong x2nmodp OF((z_off64_t n, unsigned k)); |
| 104 | 104 | ||
| 105 | /* If available, use the ARM processor CRC32 instruction. */ | 105 | /* If available, use the ARM processor CRC32 instruction. */ |
| 106 | 106 | ||
| @@ -511,7 +511,7 @@ local void braid(ltl, big, n, w) | |||
| 511 | int k; | 511 | int k; |
| 512 | z_crc_t i, p, q; | 512 | z_crc_t i, p, q; |
| 513 | for (k = 0; k < w; k++) { | 513 | for (k = 0; k < w; k++) { |
| 514 | - p = x2nmodp((n * w + 3 - k) << 3, 0); | 514 | + p = (z_crc_t)x2nmodp((n * w + 3 - k) << 3, 0); |
| 515 | ltl[k][0] = 0; | 515 | ltl[k][0] = 0; |
| 516 | big[w - 1 - k][0] = 0; | 516 | big[w - 1 - k][0] = 0; |
| 517 | for (i = 1; i < 256; i++) { | 517 | for (i = 1; i < 256; i++) { |
| @@ -561,15 +561,15 @@ local z_crc_t multmodp(a, b) | |||
| 561 | 561 | ||
| 562 | /* | 562 | /* |
| 563 | Return x^(n * 2^k) modulo p(x). Requires that x2n_table[] has been | 563 | Return x^(n * 2^k) modulo p(x). Requires that x2n_table[] has been |
| 564 | - initialized. | 564 | + initialized. n must not be negative. |
| 565 | */ | 565 | */ |
| 566 | -local z_crc_t x2nmodp(n, k) | 566 | +local uLong x2nmodp(n, k) |
| 567 | z_off64_t n; | 567 | z_off64_t n; |
| 568 | unsigned k; | 568 | unsigned k; |
| 569 | { | 569 | { |
| 570 | - z_crc_t p; | 570 | + uLong p; |
| 571 | 571 | ||
| 572 | - p = (z_crc_t)1 << 31; /* x^0 == 1 */ | 572 | + p = (uLong)1 << 31; /* x^0 == 1 */ |
| 573 | while (n) { | 573 | while (n) { |
| 574 | if (n & 1) | 574 | if (n & 1) |
| 575 | p = multmodp(x2n_table[k & 31], p); | 575 | p = multmodp(x2n_table[k & 31], p); |
| @@ -681,7 +681,7 @@ unsigned long ZEXPORT crc32_z(crc, buf, len) | |||
| 681 | } | 681 | } |
| 682 | word += 3 * last; | 682 | word += 3 * last; |
| 683 | num -= 3 * last; | 683 | num -= 3 * last; |
| 684 | - val = x2nmodp(last, 6); | 684 | + val = x2nmodp((int)last, 6); |
| 685 | crc = multmodp(val, crc) ^ crc1; | 685 | crc = multmodp(val, crc) ^ crc1; |
| 686 | crc = multmodp(val, crc) ^ crc2; | 686 | crc = multmodp(val, crc) ^ crc2; |
| 687 | } | 687 | } |
| @@ -1074,6 +1074,8 @@ uLong ZEXPORT crc32_combine64(crc1, crc2, len2) | |||
| 1074 | uLong crc2; | 1074 | uLong crc2; |
| 1075 | z_off64_t len2; | 1075 | z_off64_t len2; |
| 1076 | { | 1076 | { |
| 1077 | + if (len2 < 0) | ||
| 1078 | + return 0; | ||
| 1077 | 1079 | ||
| 1078 | once(&made, make_crc_table); | 1080 | once(&made, make_crc_table); |
| 1079 | 1081 | ||
| @@ -1092,6 +1094,8 @@ uLong ZEXPORT crc32_combine(crc1, crc2, len2) | |||
| 1092 | /* ========================================================================= */ | 1094 | /* ========================================================================= */ |
| 1093 | uLong ZEXPORT crc32_combine_gen64(z_off64_t len2) | 1095 | uLong ZEXPORT crc32_combine_gen64(z_off64_t len2) |
| 1094 | { | 1096 | { |
| 1097 | + if (len2 < 0) | ||
| 1098 | + return 0; | ||
| 1095 | 1099 | ||
| 1096 | once(&made, make_crc_table); | 1100 | once(&made, make_crc_table); |
| 1097 | 1101 | ||