mbox series

[0/4] zlib: Address CVE-2016-9841

Message ID cover.1711548887.git.michal.simek@amd.com
Headers show
Series zlib: Address CVE-2016-9841 | expand

Message

Michal Simek March 27, 2024, 2:14 p.m. UTC 
Hi,

it looks like that only CVE-2016-9841 is not fixed and this series is
trying to address it. The first two patches are just preparation based on
changes which happened in past. The third one is actual fix and the last
one is following what has been done in Linux kernel long time ago and don't
use incorrect zlib version string.

I tested it with and I can't see any issue.
./test/py/test.py --bd sandbox --build -s

And gitlab CI is also not showing any issue.

Thanks,
Michal


Michal Simek (4):
  zlib: Rename this variable to here (current decoding table entry)
  zlib: Rename write variable to wnext (window write index)
  zlib: Port fix for CVE-2016-9841 to U-Boot
  zlib: Remove incorrect ZLIB_VERSION

 include/u-boot/zlib.h |  16 ++--
 lib/gzip.c            |   2 +-
 lib/zlib/deflate.c    |  13 +---
 lib/zlib/inffast.c    | 176 ++++++++++++++++--------------------------
 lib/zlib/inflate.c    |  31 ++++----
 lib/zlib/inflate.h    |   2 +-
 lib/zlib/zutil.c      |   1 -
 7 files changed, 90 insertions(+), 151 deletions(-)

Comments

Tom Rini March 28, 2024, 8:02 p.m. UTC | #1 
On Wed, Mar 27, 2024 at 03:14:49PM +0100, Michal Simek wrote:
> Hi,
> 
> it looks like that only CVE-2016-9841 is not fixed and this series is
> trying to address it. The first two patches are just preparation based on
> changes which happened in past. The third one is actual fix and the last
> one is following what has been done in Linux kernel long time ago and don't
> use incorrect zlib version string.
> 
> I tested it with and I can't see any issue.
> ./test/py/test.py --bd sandbox --build -s
> 
> And gitlab CI is also not showing any issue.

Thanks for taking this on. I've given it a quick spin on some Pi
platforms as well as before/after and I see that it's also reducing the
overall binary size everywhere as well.
Tom Rini April 12, 2024, 9:59 p.m. UTC | #2 
On Wed, 27 Mar 2024 15:14:49 +0100, Michal Simek wrote:

> it looks like that only CVE-2016-9841 is not fixed and this series is
> trying to address it. The first two patches are just preparation based on
> changes which happened in past. The third one is actual fix and the last
> one is following what has been done in Linux kernel long time ago and don't
> use incorrect zlib version string.
> 
> I tested it with and I can't see any issue.
> ./test/py/test.py --bd sandbox --build -s
> 
> [...]

Applied to u-boot/master, thanks!