stv0g/libwebsockets
1
0
Fork 0
Code Issues Pull requests Releases Wiki Activity

zlib: Avoid pre-decrement of pointer in big-endian CRC calculation

Browse source 
There was a small optimization for PowerPCs to pre-increment a
pointer when accessing a word, instead of post-incrementing. This
required prefacing the loop with a decrement of the pointer,
possibly pointing before the object passed. This is not compliant
with the C standard, for which decrementing a pointer before its
allocated memory is undefined. When tested on a modern PowerPC
with a modern compiler, the optimization no longer has any effect.
Due to all that, and per the recommendation of a security audit of
the zlib code by Trail of Bits and TrustInSoft, in support of the
Mozilla Foundation, this "optimization" was removed, in order to
avoid the possibility of undefined behavior.

d1d577490c.patch
This commit is contained in:
Mark Adler 2016-09-28 20:20:25 -07:00 • committed by Andy Green
parent b807ccf261
commit 74b4775908
1 changed files with 1 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
win32port/zlib/crc32.c
View file

@ -295,7 +295,7 @@ local unsigned long crc32_little(crc, buf, len)
}
/* ========================================================================= */
#define DOBIG4 c ^= *++buf4; \
#define DOBIG4 c ^= *buf4++; \
c = crc_table[4][c & 0xff] ^ crc_table[5][(c >> 8) & 0xff] ^ \
crc_table[6][(c >> 16) & 0xff] ^ crc_table[7][c >> 24]
#define DOBIG32 DOBIG4; DOBIG4; DOBIG4; DOBIG4; DOBIG4; DOBIG4; DOBIG4; DOBIG4
@ -317,7 +317,6 @@ local unsigned long crc32_big(crc, buf, len)
}
buf4 = (const u4 FAR *)(const void FAR *)buf;
buf4--;
while (len >= 32) {
DOBIG32;
len -= 32;
@ -326,7 +325,6 @@ local unsigned long crc32_big(crc, buf, len)
DOBIG4;
len -= 4;
}
buf4++;
buf = (const unsigned char FAR *)buf4;
if (len) do {