From 370d083f6e08e210c4407c4e640e94bad48b6364 Mon Sep 17 00:00:00 2001
From: allanjude <allanjude@FreeBSD.org>
Date: Sun, 11 Sep 2016 17:48:06 +0000
Subject: [PATCH] MFV r268120:   4936 lz4 could theoretically overflow a
 pointer with a certain input

  illumos/illumos-gate@58d0718061c87e3d647c891ec5281b93c08dba4e

Reviewed by:	delphij
MFC after:	2 weeks
Sponsored by:	ScaleEngine Inc.
Differential Revision:	https://reviews.freebsd.org/D7850
---
 .../opensolaris/uts/common/fs/zfs/lz4.c       | 24 +++++++++----------
 1 file changed, 12 insertions(+), 12 deletions(-)

diff --git a/sys/cddl/contrib/opensolaris/uts/common/fs/zfs/lz4.c b/sys/cddl/contrib/opensolaris/uts/common/fs/zfs/lz4.c
index a7691d6ba495..79f43f387997 100644
--- a/sys/cddl/contrib/opensolaris/uts/common/fs/zfs/lz4.c
+++ b/sys/cddl/contrib/opensolaris/uts/common/fs/zfs/lz4.c
@@ -187,21 +187,18 @@ lz4_decompress(void *s_start, void *d_start, size_t s_len, size_t d_len, int n)
     defined(__amd64) || defined(__ppc64__) || defined(_WIN64) || \
     defined(__LP64__) || defined(_LP64))
 #define	LZ4_ARCH64 1
+#else
+#define	LZ4_ARCH64 0
+#endif
+
 /*
- * Illumos: On amd64 we have 20k of stack and 24k on sun4u and sun4v, so we
- * can spend 16k on the algorithm
+ * Limits the amount of stack space that the algorithm may consume to hold
+ * the compression lookup table. The value `9' here means we'll never use
+ * more than 2k of stack (see above for a description of COMPRESSIONLEVEL).
+ * If more memory is needed, it is allocated from the heap.
  */
 /* FreeBSD: Use heap for all platforms for now */
 #define	STACKLIMIT 0
-#else
-#define	LZ4_ARCH64 0
-/*
- * Illumos: On i386 we only have 12k of stack, so in order to maintain the
- * same COMPRESSIONLEVEL we have to use heap allocation. Performance will
- * suck, but alas, it's ZFS on 32-bit we're talking about, so...
- */
-#define	STACKLIMIT 0
-#endif
 
 /*
  * Little Endian or Big Endian?
@@ -870,7 +867,7 @@ real_LZ4_compress(const char *source, char *dest, int isize, int osize)
 /* Decompression functions */
 
 /*
- * Note: The decoding functionLZ4_uncompress_unknownOutputSize() is safe
+ * Note: The decoding function LZ4_uncompress_unknownOutputSize() is safe
  *	against "buffer overflow" attack type. They will never write nor
  *	read outside of the provided output buffers.
  *	LZ4_uncompress_unknownOutputSize() also insures that it will never
@@ -913,6 +910,9 @@ LZ4_uncompress_unknownOutputSize(const char *source, char *dest, int isize,
 		}
 		/* copy literals */
 		cpy = op + length;
+		/* CORNER-CASE: cpy might overflow. */
+		if (cpy < op)
+			goto _output_error;	/* cpy was overflowed, bail! */
 		if ((cpy > oend - COPYLENGTH) ||
 		    (ip + length > iend - COPYLENGTH)) {
 			if (cpy > oend)