11cb0ef41Sopenharmony_ciFrom 92537ee19784e0e545f06d89b7d89ab532a18cff Mon Sep 17 00:00:00 2001 21cb0ef41Sopenharmony_ciFrom: Hans Wennborg <hans@chromium.org> 31cb0ef41Sopenharmony_ciDate: Tue, 3 Nov 2020 15:54:09 +0100 41cb0ef41Sopenharmony_ciSubject: [PATCH] [zlib] Zero-initialize the window used for deflation 51cb0ef41Sopenharmony_ci 61cb0ef41Sopenharmony_ciOtherwise MSan complains about use-of-uninitialized values in the 71cb0ef41Sopenharmony_ciwindow. 81cb0ef41Sopenharmony_ciThis happens in both regular deflate's longest_match and deflate_rle. 91cb0ef41Sopenharmony_ci 101cb0ef41Sopenharmony_ciBefore crrev.com/822755 we used to suppress those reports, but it seems 111cb0ef41Sopenharmony_cibetter to fix it properly. That will also allow us to catch other 121cb0ef41Sopenharmony_cipotential issues with MSan in these functions. 131cb0ef41Sopenharmony_ci 141cb0ef41Sopenharmony_ciThe instances of this that we've seen only reproduce with 151cb0ef41Sopenharmony_cifill_window_sse(), not with the regular fill_window() function. Since 161cb0ef41Sopenharmony_cithe former doesn't exist in upstream zlib, I'm not planning to send this 171cb0ef41Sopenharmony_cipatch upstream. 181cb0ef41Sopenharmony_ci 191cb0ef41Sopenharmony_ciBug: 1137613, 1144420 201cb0ef41Sopenharmony_ci--- 211cb0ef41Sopenharmony_ci third_party/zlib/deflate.c | 3 +++ 221cb0ef41Sopenharmony_ci 1 file changed, 3 insertions(+) 231cb0ef41Sopenharmony_ci 241cb0ef41Sopenharmony_cidiff --git a/third_party/zlib/deflate.c b/third_party/zlib/deflate.c 251cb0ef41Sopenharmony_ciindex 8bf93e524875..fc7ae45905ff 100644 261cb0ef41Sopenharmony_ci--- a/third_party/zlib/deflate.c 271cb0ef41Sopenharmony_ci+++ b/third_party/zlib/deflate.c 281cb0ef41Sopenharmony_ci@@ -321,6 +321,9 @@ int ZEXPORT deflateInit2_(strm, level, method, windowBits, memLevel, strategy, 291cb0ef41Sopenharmony_ci s->window = (Bytef *) ZALLOC(strm, 301cb0ef41Sopenharmony_ci s->w_size + window_padding, 311cb0ef41Sopenharmony_ci 2*sizeof(Byte)); 321cb0ef41Sopenharmony_ci+ /* Avoid use of unitialized values in the window, see crbug.com/1137613 and 331cb0ef41Sopenharmony_ci+ * crbug.com/1144420 */ 341cb0ef41Sopenharmony_ci+ zmemzero(s->window, (s->w_size + window_padding) * (2 * sizeof(Byte))); 351cb0ef41Sopenharmony_ci s->prev = (Posf *) ZALLOC(strm, s->w_size, sizeof(Pos)); 361cb0ef41Sopenharmony_ci /* Avoid use of uninitialized value, see: 371cb0ef41Sopenharmony_ci * https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11360 381cb0ef41Sopenharmony_ci-- 391cb0ef41Sopenharmony_ci2.29.1.341.ge80a0c044ae-goog 401cb0ef41Sopenharmony_ci 41