Re: [PATCH] lib/lzo: check output space before writing the RLE header

[Herbert Xu <herbert@gondor.apana.org.au>]

On Fri, Oct 16, 2026 at 05:09:03PM +0000, Sean Snider wrote:
> The safe LZO-RLE compressor writes its two-byte version header before
> checking the available output space. With an output capacity of zero or
> one, these stores exceed the supplied limit. Advancing op past op_end
> also makes the unsigned HAVE_OP() comparison accept later writes.
> 
> Check for the two header bytes before emitting them. Use the existing
> output_overrun path, leaving the output length unchanged on this error.
> Ordinary LZO does not emit this header. Valid output is unchanged.
> 
> Bounded userspace tests of the kernel codec under ASan/UBSan reproduced
> the boundary violation and passed after the correction. Successful
> full-capacity streams remained byte-identical, and the existing Crypto
> LZO and LZO-RLE compression vectors passed.
> 
> Fixes: cc47f07234f7 ("crypto: lzo - Fix compression buffer overrun")
> Assisted-by: LLM
> Signed-off-by: Sean Snider <ssnider5@outlook.com>
> ---
>  lib/lzo/lzo1x_compress.c | 1 +
>  1 file changed, 1 insertion(+)

Patch applied.  Thanks.
-- 
Email: Herbert Xu <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt