| From 92537ee19784e0e545f06d89b7d89ab532a18cff Mon Sep 17 00:00:00 2001 |
| From: Hans Wennborg <hans@chromium.org> |
| Date: Tue, 3 Nov 2020 15:54:09 +0100 |
| Subject: [PATCH] [zlib] Zero-initialize the window used for deflation |
| |
| Otherwise MSan complains about use-of-uninitialized values in the |
| window. |
| This happens in both regular deflate's longest_match and deflate_rle. |
| |
| Before crrev.com/822755 we used to suppress those reports, but it seems |
| better to fix it properly. That will also allow us to catch other |
| potential issues with MSan in these functions. |
| |
| The instances of this that we've seen only reproduce with |
| fill_window_sse(), not with the regular fill_window() function. Since |
| the former doesn't exist in upstream zlib, I'm not planning to send this |
| patch upstream. |
| |
| Bug: 1137613, 1144420 |
| --- |
| third_party/zlib/deflate.c | 3 +++ |
| 1 file changed, 3 insertions(+) |
| |
| diff --git a/third_party/zlib/deflate.c b/third_party/zlib/deflate.c |
| index 8bf93e524875..fc7ae45905ff 100644 |
| --- a/third_party/zlib/deflate.c |
| +++ b/third_party/zlib/deflate.c |
| @@ -321,6 +321,9 @@ int ZEXPORT deflateInit2_(strm, level, method, windowBits, memLevel, strategy, |
| s->window = (Bytef *) ZALLOC(strm, |
| s->w_size + window_padding, |
| 2*sizeof(Byte)); |
| + /* Avoid use of unitialized values in the window, see crbug.com/1137613 and |
| + * crbug.com/1144420 */ |
| + zmemzero(s->window, (s->w_size + window_padding) * (2 * sizeof(Byte))); |
| s->prev = (Posf *) ZALLOC(strm, s->w_size, sizeof(Pos)); |
| /* Avoid use of uninitialized value, see: |
| * https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11360 |
| -- |
| 2.29.1.341.ge80a0c044ae-goog |
| |
