libpayload: cbfs: Require input size and output size for cbfs_decompress

Currently, cbfs_decompress() calls ulzma() and ulz4f() for LZMA/LZ4
decompression. These two functions don't accept input/output size as
parameters. We can make cbfs_decompress more robust by calling ulzman()
and ulz4fn() instead. This could prevent us from overflowing destination
buffer.

BUG=none
BRANCH=none
TEST=boot into kernel on Kukui with COMPRESSED_PAYLOAD_LZMA /
     COMPRESSED_PAYLOAD_LZ4.

Change-Id: Ibe617825bd000ed618791d8e3c5f65bbbd5f7e33
Signed-off-by: You-Cheng Syu <youcheng@google.com>
Reviewed-on: https://review.coreboot.org/c/31606
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
Reviewed-by: Julius Werner <jwerner@chromium.org>
Reviewed-by: Daisuke Nojiri <dnojiri@chromium.org>

1 files changed, 12 insertions, 7 deletions

diff --git a/payloads/libpayload/libcbfs/cbfs_core.c b/payloads/libpayload/libcbfs/cbfs_core.c
index 91f2603446..4ecda30395 100644
--- a/payloads/libpayload/libcbfs/cbfs_core.c
+++ b/payloads/libpayload/libcbfs/cbfs_core.c
@@ -48,6 +48,7 @@
  *
  */
 
+#include <libpayload.h>
 #include <cbfs.h>
 #include <string.h>
 #include <sysinfo.h>
@@ -256,7 +257,8 @@ void *cbfs_get_contents(struct cbfs_handle *handle, size_t *size, size_t limit)
 		return NULL;
 
 	ret = malloc(*size);
-	if (ret != NULL && !cbfs_decompress(algo, data, ret, *size)) {
+	if (ret != NULL &&
+	    !cbfs_decompress(algo, data, on_media_size, ret, *size)) {
 		free(ret);
 		ret = NULL;
 	}
@@ -321,24 +323,27 @@ void *cbfs_get_attr(struct cbfs_handle *handle, uint32_t tag)
 	return NULL;
 }
 
-int cbfs_decompress(int algo, void *src, void *dst, int len)
+size_t cbfs_decompress(int algo, const void *src, size_t srcn, void *dst,
+		       size_t dstn)
 {
+	size_t len;
 	switch (algo) {
 		case CBFS_COMPRESS_NONE:
+			len = MIN(srcn, dstn);
 			memcpy(dst, src, len);
 			return len;
 #ifdef CBFS_CORE_WITH_LZMA
 		case CBFS_COMPRESS_LZMA:
-			return ulzma(src, dst);
+			return ulzman(src, srcn, dst, dstn);
 #endif
 #ifdef CBFS_CORE_WITH_LZ4
 		case CBFS_COMPRESS_LZ4:
-			return ulz4f(src, dst);
+			return ulz4fn(src, srcn, dst, dstn);
 #endif
 		default:
-			ERROR("tried to decompress %d bytes with algorithm #%x,"
-			      "but that algorithm id is unsupported.\n", len,
-			      algo);
+			ERROR("tried to decompress %zu bytes with algorithm "
+			      "#%x, but that algorithm id is unsupported.\n",
+			      srcn, algo);
 			return 0;
 	}
 }