mirror of
https://github.com/opnsense/src.git
synced 2026-02-22 17:32:57 -05:00
The program reads oldsize bytes from oldfile, and proceeds to initialize a suffix array of oldsize elements using divsufsort(). As per the function's API [1], array indices 0 through n-1 are initialized. Later, search() is called, but with index bounds [0, n]. Depending on the contents of the malloc'd buffer, accessing this uninitialized index at the end of can result in a segmentation fault. Fix this by passing oldsize-1 to search(), limiting the search bounds to [0, n-1]. This bug is a result of r303285, which introduced divsufsort() as an alternate suffix sorting function to the existing qsufsort(). It seems that qsufsort() did initialize the final empty element, meaning it could be safely accessed. This difference in the implementations was missed at the time. [1] https://github.com/y-256/libdivsufsort Discussed with: cperciva MFC after: 1 week Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D26911
340 lines
8.6 KiB
C
340 lines
8.6 KiB
C
/*-
|
|
* SPDX-License-Identifier: BSD-2-Clause-FreeBSD
|
|
*
|
|
* Copyright 2003-2005 Colin Percival
|
|
* All rights reserved
|
|
*
|
|
* Redistribution and use in source and binary forms, with or without
|
|
* modification, are permitted providing that the following conditions
|
|
* are met:
|
|
* 1. Redistributions of source code must retain the above copyright
|
|
* notice, this list of conditions and the following disclaimer.
|
|
* 2. Redistributions in binary form must reproduce the above copyright
|
|
* notice, this list of conditions and the following disclaimer in the
|
|
* documentation and/or other materials provided with the distribution.
|
|
*
|
|
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
|
|
* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
|
|
* WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
|
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
|
|
* DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
|
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
|
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
|
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
|
|
* STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
|
|
* IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
|
|
* POSSIBILITY OF SUCH DAMAGE.
|
|
*/
|
|
|
|
#include <sys/cdefs.h>
|
|
__FBSDID("$FreeBSD$");
|
|
|
|
#include <sys/types.h>
|
|
|
|
#include <bzlib.h>
|
|
#include <err.h>
|
|
#include <errno.h>
|
|
#include <fcntl.h>
|
|
#include <limits.h>
|
|
#include <stdint.h>
|
|
#include <stdio.h>
|
|
#include <stdlib.h>
|
|
#include <string.h>
|
|
#include <unistd.h>
|
|
|
|
#ifndef O_BINARY
|
|
#define O_BINARY 0
|
|
#endif
|
|
|
|
#include "divsufsort64.h"
|
|
#define saidx_t saidx64_t
|
|
#define divsufsort divsufsort64
|
|
|
|
#define MIN(x,y) (((x)<(y)) ? (x) : (y))
|
|
|
|
static off_t matchlen(u_char *old,off_t oldsize,u_char *new,off_t newsize)
|
|
{
|
|
off_t i;
|
|
|
|
for(i=0;(i<oldsize)&&(i<newsize);i++)
|
|
if(old[i]!=new[i]) break;
|
|
|
|
return i;
|
|
}
|
|
|
|
static off_t search(off_t *I,u_char *old,off_t oldsize,
|
|
u_char *new,off_t newsize,off_t st,off_t en,off_t *pos)
|
|
{
|
|
off_t x,y;
|
|
|
|
if(en-st<2) {
|
|
x=matchlen(old+I[st],oldsize-I[st],new,newsize);
|
|
y=matchlen(old+I[en],oldsize-I[en],new,newsize);
|
|
|
|
if(x>y) {
|
|
*pos=I[st];
|
|
return x;
|
|
} else {
|
|
*pos=I[en];
|
|
return y;
|
|
}
|
|
}
|
|
|
|
x=st+(en-st)/2;
|
|
if(memcmp(old+I[x],new,MIN(oldsize-I[x],newsize))<0) {
|
|
return search(I,old,oldsize,new,newsize,x,en,pos);
|
|
} else {
|
|
return search(I,old,oldsize,new,newsize,st,x,pos);
|
|
};
|
|
}
|
|
|
|
static void offtout(off_t x,u_char *buf)
|
|
{
|
|
off_t y;
|
|
|
|
if(x<0) y=-x; else y=x;
|
|
|
|
buf[0]=y%256;y-=buf[0];
|
|
y=y/256;buf[1]=y%256;y-=buf[1];
|
|
y=y/256;buf[2]=y%256;y-=buf[2];
|
|
y=y/256;buf[3]=y%256;y-=buf[3];
|
|
y=y/256;buf[4]=y%256;y-=buf[4];
|
|
y=y/256;buf[5]=y%256;y-=buf[5];
|
|
y=y/256;buf[6]=y%256;y-=buf[6];
|
|
y=y/256;buf[7]=y%256;
|
|
|
|
if(x<0) buf[7]|=0x80;
|
|
}
|
|
|
|
static void
|
|
usage(void)
|
|
{
|
|
|
|
fprintf(stderr, "usage: bsdiff oldfile newfile patchfile\n");
|
|
exit(1);
|
|
}
|
|
|
|
int main(int argc,char *argv[])
|
|
{
|
|
int fd;
|
|
u_char *old,*new;
|
|
off_t oldsize,newsize;
|
|
saidx_t *I;
|
|
off_t scan,pos,len;
|
|
off_t lastscan,lastpos,lastoffset;
|
|
off_t oldscore,scsc;
|
|
off_t s,Sf,lenf,Sb,lenb;
|
|
off_t overlap,Ss,lens;
|
|
off_t i;
|
|
off_t dblen,eblen;
|
|
u_char *db,*eb;
|
|
u_char buf[8];
|
|
u_char header[32];
|
|
FILE * pf;
|
|
BZFILE * pfbz2;
|
|
int bz2err;
|
|
|
|
if (argc != 4)
|
|
usage();
|
|
|
|
/* Allocate oldsize+1 bytes instead of oldsize bytes to ensure
|
|
that we never try to malloc(0) and get a NULL pointer */
|
|
if(((fd=open(argv[1],O_RDONLY|O_BINARY,0))<0) ||
|
|
((oldsize=lseek(fd,0,SEEK_END))==-1))
|
|
err(1, "%s", argv[1]);
|
|
|
|
if (oldsize > SSIZE_MAX ||
|
|
(uintmax_t)oldsize >= SIZE_T_MAX / sizeof(off_t) ||
|
|
oldsize == OFF_MAX) {
|
|
errno = EFBIG;
|
|
err(1, "%s", argv[1]);
|
|
}
|
|
|
|
if (((old=malloc(oldsize+1))==NULL) ||
|
|
(lseek(fd,0,SEEK_SET)!=0) ||
|
|
(read(fd,old,oldsize)!=oldsize) ||
|
|
(close(fd)==-1)) err(1,"%s",argv[1]);
|
|
|
|
if(((I=malloc((oldsize+1)*sizeof(saidx_t)))==NULL)) err(1,NULL);
|
|
|
|
if(divsufsort(old, I, oldsize)) err(1, "divsufsort");
|
|
|
|
/* Allocate newsize+1 bytes instead of newsize bytes to ensure
|
|
that we never try to malloc(0) and get a NULL pointer */
|
|
if(((fd=open(argv[2],O_RDONLY|O_BINARY,0))<0) ||
|
|
((newsize=lseek(fd,0,SEEK_END))==-1))
|
|
err(1, "%s", argv[2]);
|
|
|
|
if (newsize > SSIZE_MAX || (uintmax_t)newsize >= SIZE_T_MAX ||
|
|
newsize == OFF_MAX) {
|
|
errno = EFBIG;
|
|
err(1, "%s", argv[2]);
|
|
}
|
|
|
|
if (((new=malloc(newsize+1))==NULL) ||
|
|
(lseek(fd,0,SEEK_SET)!=0) ||
|
|
(read(fd,new,newsize)!=newsize) ||
|
|
(close(fd)==-1)) err(1,"%s",argv[2]);
|
|
|
|
if(((db=malloc(newsize+1))==NULL) ||
|
|
((eb=malloc(newsize+1))==NULL)) err(1,NULL);
|
|
dblen=0;
|
|
eblen=0;
|
|
|
|
/* Create the patch file */
|
|
if ((pf = fopen(argv[3], "wb")) == NULL)
|
|
err(1, "%s", argv[3]);
|
|
|
|
/* Header is
|
|
0 8 "BSDIFF40"
|
|
8 8 length of bzip2ed ctrl block
|
|
16 8 length of bzip2ed diff block
|
|
24 8 length of new file */
|
|
/* File is
|
|
0 32 Header
|
|
32 ?? Bzip2ed ctrl block
|
|
?? ?? Bzip2ed diff block
|
|
?? ?? Bzip2ed extra block */
|
|
memcpy(header,"BSDIFF40",8);
|
|
offtout(0, header + 8);
|
|
offtout(0, header + 16);
|
|
offtout(newsize, header + 24);
|
|
if (fwrite(header, 32, 1, pf) != 1)
|
|
err(1, "fwrite(%s)", argv[3]);
|
|
|
|
/* Compute the differences, writing ctrl as we go */
|
|
if ((pfbz2 = BZ2_bzWriteOpen(&bz2err, pf, 9, 0, 0)) == NULL)
|
|
errx(1, "BZ2_bzWriteOpen, bz2err = %d", bz2err);
|
|
scan=0;len=0;pos=0;
|
|
lastscan=0;lastpos=0;lastoffset=0;
|
|
while(scan<newsize) {
|
|
oldscore=0;
|
|
|
|
for(scsc=scan+=len;scan<newsize;scan++) {
|
|
len=search(I,old,oldsize,new+scan,newsize-scan,
|
|
0,oldsize-1,&pos);
|
|
|
|
for(;scsc<scan+len;scsc++)
|
|
if((scsc+lastoffset<oldsize) &&
|
|
(old[scsc+lastoffset] == new[scsc]))
|
|
oldscore++;
|
|
|
|
if(((len==oldscore) && (len!=0)) ||
|
|
(len>oldscore+8)) break;
|
|
|
|
if((scan+lastoffset<oldsize) &&
|
|
(old[scan+lastoffset] == new[scan]))
|
|
oldscore--;
|
|
}
|
|
|
|
if((len!=oldscore) || (scan==newsize)) {
|
|
s=0;Sf=0;lenf=0;
|
|
for(i=0;(lastscan+i<scan)&&(lastpos+i<oldsize);) {
|
|
if(old[lastpos+i]==new[lastscan+i]) s++;
|
|
i++;
|
|
if(s*2-i>Sf*2-lenf) { Sf=s; lenf=i; }
|
|
}
|
|
|
|
lenb=0;
|
|
if(scan<newsize) {
|
|
s=0;Sb=0;
|
|
for(i=1;(scan>=lastscan+i)&&(pos>=i);i++) {
|
|
if(old[pos-i]==new[scan-i]) s++;
|
|
if(s*2-i>Sb*2-lenb) { Sb=s; lenb=i; }
|
|
}
|
|
}
|
|
|
|
if(lastscan+lenf>scan-lenb) {
|
|
overlap=(lastscan+lenf)-(scan-lenb);
|
|
s=0;Ss=0;lens=0;
|
|
for(i=0;i<overlap;i++) {
|
|
if(new[lastscan+lenf-overlap+i]==
|
|
old[lastpos+lenf-overlap+i]) s++;
|
|
if(new[scan-lenb+i]==
|
|
old[pos-lenb+i]) s--;
|
|
if(s>Ss) { Ss=s; lens=i+1; }
|
|
}
|
|
|
|
lenf+=lens-overlap;
|
|
lenb-=lens;
|
|
}
|
|
|
|
for(i=0;i<lenf;i++)
|
|
db[dblen+i]=new[lastscan+i]-old[lastpos+i];
|
|
for(i=0;i<(scan-lenb)-(lastscan+lenf);i++)
|
|
eb[eblen+i]=new[lastscan+lenf+i];
|
|
|
|
dblen+=lenf;
|
|
eblen+=(scan-lenb)-(lastscan+lenf);
|
|
|
|
offtout(lenf,buf);
|
|
BZ2_bzWrite(&bz2err, pfbz2, buf, 8);
|
|
if (bz2err != BZ_OK)
|
|
errx(1, "BZ2_bzWrite, bz2err = %d", bz2err);
|
|
|
|
offtout((scan-lenb)-(lastscan+lenf),buf);
|
|
BZ2_bzWrite(&bz2err, pfbz2, buf, 8);
|
|
if (bz2err != BZ_OK)
|
|
errx(1, "BZ2_bzWrite, bz2err = %d", bz2err);
|
|
|
|
offtout((pos-lenb)-(lastpos+lenf),buf);
|
|
BZ2_bzWrite(&bz2err, pfbz2, buf, 8);
|
|
if (bz2err != BZ_OK)
|
|
errx(1, "BZ2_bzWrite, bz2err = %d", bz2err);
|
|
|
|
lastscan=scan-lenb;
|
|
lastpos=pos-lenb;
|
|
lastoffset=pos-scan;
|
|
}
|
|
}
|
|
BZ2_bzWriteClose(&bz2err, pfbz2, 0, NULL, NULL);
|
|
if (bz2err != BZ_OK)
|
|
errx(1, "BZ2_bzWriteClose, bz2err = %d", bz2err);
|
|
|
|
/* Compute size of compressed ctrl data */
|
|
if ((len = ftello(pf)) == -1)
|
|
err(1, "ftello");
|
|
offtout(len-32, header + 8);
|
|
|
|
/* Write compressed diff data */
|
|
if ((pfbz2 = BZ2_bzWriteOpen(&bz2err, pf, 9, 0, 0)) == NULL)
|
|
errx(1, "BZ2_bzWriteOpen, bz2err = %d", bz2err);
|
|
BZ2_bzWrite(&bz2err, pfbz2, db, dblen);
|
|
if (bz2err != BZ_OK)
|
|
errx(1, "BZ2_bzWrite, bz2err = %d", bz2err);
|
|
BZ2_bzWriteClose(&bz2err, pfbz2, 0, NULL, NULL);
|
|
if (bz2err != BZ_OK)
|
|
errx(1, "BZ2_bzWriteClose, bz2err = %d", bz2err);
|
|
|
|
/* Compute size of compressed diff data */
|
|
if ((newsize = ftello(pf)) == -1)
|
|
err(1, "ftello");
|
|
offtout(newsize - len, header + 16);
|
|
|
|
/* Write compressed extra data */
|
|
if ((pfbz2 = BZ2_bzWriteOpen(&bz2err, pf, 9, 0, 0)) == NULL)
|
|
errx(1, "BZ2_bzWriteOpen, bz2err = %d", bz2err);
|
|
BZ2_bzWrite(&bz2err, pfbz2, eb, eblen);
|
|
if (bz2err != BZ_OK)
|
|
errx(1, "BZ2_bzWrite, bz2err = %d", bz2err);
|
|
BZ2_bzWriteClose(&bz2err, pfbz2, 0, NULL, NULL);
|
|
if (bz2err != BZ_OK)
|
|
errx(1, "BZ2_bzWriteClose, bz2err = %d", bz2err);
|
|
|
|
/* Seek to the beginning, write the header, and close the file */
|
|
if (fseeko(pf, 0, SEEK_SET))
|
|
err(1, "fseeko");
|
|
if (fwrite(header, 32, 1, pf) != 1)
|
|
err(1, "fwrite(%s)", argv[3]);
|
|
if (fclose(pf))
|
|
err(1, "fclose");
|
|
|
|
/* Free the memory we used */
|
|
free(db);
|
|
free(eb);
|
|
free(I);
|
|
free(old);
|
|
free(new);
|
|
|
|
return 0;
|
|
}
|