aboutsummaryrefslogtreecommitdiff
path: root/crc32.c
diff options
context:
space:
mode:
authorMark Adler <madler@alumni.caltech.edu>2016-09-28 20:20:25 -0700
committerMark Adler <madler@alumni.caltech.edu>2016-09-28 20:48:38 -0700
commitd1d577490c15a0c6862473d7576352a9f18ef811 (patch)
tree1d60d9150c67eb2c7fec06c5c7e1b61b6f7d9145 /crc32.c
parent6a043145ca6e9c55184013841a67b2fef87e44c0 (diff)
downloadzlib-d1d577490c15a0c6862473d7576352a9f18ef811.tar.gz
zlib-d1d577490c15a0c6862473d7576352a9f18ef811.tar.bz2
zlib-d1d577490c15a0c6862473d7576352a9f18ef811.zip
Avoid pre-decrement of pointer in big-endian CRC calculation.
There was a small optimization for PowerPCs to pre-increment a pointer when accessing a word, instead of post-incrementing. This required prefacing the loop with a decrement of the pointer, possibly pointing before the object passed. This is not compliant with the C standard, for which decrementing a pointer before its allocated memory is undefined. When tested on a modern PowerPC with a modern compiler, the optimization no longer has any effect. Due to all that, and per the recommendation of a security audit of the zlib code by Trail of Bits and TrustInSoft, in support of the Mozilla Foundation, this "optimization" was removed, in order to avoid the possibility of undefined behavior.
Diffstat (limited to 'crc32.c')
-rw-r--r--crc32.c4
1 files changed, 1 insertions, 3 deletions
diff --git a/crc32.c b/crc32.c
index 979a719..05733f4 100644
--- a/crc32.c
+++ b/crc32.c
@@ -278,7 +278,7 @@ local unsigned long crc32_little(crc, buf, len)
278} 278}
279 279
280/* ========================================================================= */ 280/* ========================================================================= */
281#define DOBIG4 c ^= *++buf4; \ 281#define DOBIG4 c ^= *buf4++; \
282 c = crc_table[4][c & 0xff] ^ crc_table[5][(c >> 8) & 0xff] ^ \ 282 c = crc_table[4][c & 0xff] ^ crc_table[5][(c >> 8) & 0xff] ^ \
283 crc_table[6][(c >> 16) & 0xff] ^ crc_table[7][c >> 24] 283 crc_table[6][(c >> 16) & 0xff] ^ crc_table[7][c >> 24]
284#define DOBIG32 DOBIG4; DOBIG4; DOBIG4; DOBIG4; DOBIG4; DOBIG4; DOBIG4; DOBIG4 284#define DOBIG32 DOBIG4; DOBIG4; DOBIG4; DOBIG4; DOBIG4; DOBIG4; DOBIG4; DOBIG4
@@ -300,7 +300,6 @@ local unsigned long crc32_big(crc, buf, len)
300 } 300 }
301 301
302 buf4 = (const z_crc_t FAR *)(const void FAR *)buf; 302 buf4 = (const z_crc_t FAR *)(const void FAR *)buf;
303 buf4--;
304 while (len >= 32) { 303 while (len >= 32) {
305 DOBIG32; 304 DOBIG32;
306 len -= 32; 305 len -= 32;
@@ -309,7 +308,6 @@ local unsigned long crc32_big(crc, buf, len)
309 DOBIG4; 308 DOBIG4;
310 len -= 4; 309 len -= 4;
311 } 310 }
312 buf4++;
313 buf = (const unsigned char FAR *)buf4; 311 buf = (const unsigned char FAR *)buf4;
314 312
315 if (len) do { 313 if (len) do {