[PATCH] lib/lzo: check output space before writing the RLE header

[PATCH] lib/lzo: check output space before writing the RLE header

[Sean Snider]

The safe LZO-RLE compressor writes its two-byte version header before
checking the available output space. With an output capacity of zero or
one, these stores exceed the supplied limit. Advancing op past op_end
also makes the unsigned HAVE_OP() comparison accept later writes.

Check for the two header bytes before emitting them. Use the existing
output_overrun path, leaving the output length unchanged on this error.
Ordinary LZO does not emit this header. Valid output is unchanged.

Bounded userspace tests of the kernel codec under ASan/UBSan reproduced
the boundary violation and passed after the correction. Successful
full-capacity streams remained byte-identical, and the existing Crypto
LZO and LZO-RLE compression vectors passed.

Fixes: cc47f07234f7 ("crypto: lzo - Fix compression buffer overrun")
Assisted-by: LLM
Signed-off-by: Sean Snider <ssnider5@outlook.com>
---
 lib/lzo/lzo1x_compress.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/lib/lzo/lzo1x_compress.c b/lib/lzo/lzo1x_compress.c
index 01586af23..621bbb969 100644
--- a/lib/lzo/lzo1x_compress.c
+++ b/lib/lzo/lzo1x_compress.c
@@ -349,6 +349,7 @@ static int LZO_SAFE(lzogeneric1x_1_compress)(
 	// LZO v0 will never write 17 as first byte (except for zero-length
 	// input), so this is used to version the bitstream
 	if (bitstream_version > 0) {
+		NEED_OP(2);
 		*op++ = 17;
 		*op++ = bitstream_version;
 		m4_max_offset = M4_MAX_OFFSET_V1;
-- 
2.43.0

Re: [PATCH] lib/lzo: check output space before writing the RLE header

[Herbert Xu]

On Fri, Oct 16, 2026 at 05:09:03PM +0000, Sean Snider wrote:
> The safe LZO-RLE compressor writes its two-byte version header before
> checking the available output space. With an output capacity of zero or
> one, these stores exceed the supplied limit. Advancing op past op_end
> also makes the unsigned HAVE_OP() comparison accept later writes.
> 
> Check for the two header bytes before emitting them. Use the existing
> output_overrun path, leaving the output length unchanged on this error.
> Ordinary LZO does not emit this header. Valid output is unchanged.
> 
> Bounded userspace tests of the kernel codec under ASan/UBSan reproduced
> the boundary violation and passed after the correction. Successful
> full-capacity streams remained byte-identical, and the existing Crypto
> LZO and LZO-RLE compression vectors passed.
> 
> Fixes: cc47f07234f7 ("crypto: lzo - Fix compression buffer overrun")
> Assisted-by: LLM
> Signed-off-by: Sean Snider <ssnider5@outlook.com>
> ---
>  lib/lzo/lzo1x_compress.c | 1 +
>  1 file changed, 1 insertion(+)

Patch applied.  Thanks.
-- 
Email: Herbert Xu <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt