Skip to content

Commit 037fd5f

Browse files
[AutoPR- Security] Patch lz4 for CVE-2025-62813 [MEDIUM] (microsoft#14912)
Co-authored-by: Kanishk Bansal <[email protected]>
1 parent cb33432 commit 037fd5f

File tree

4 files changed

+85
-10
lines changed

4 files changed

+85
-10
lines changed

SPECS/lz4/CVE-2025-62813.patch

Lines changed: 71 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,71 @@
1+
From e2441290577968c02ff745c8002c5ef080540717 Mon Sep 17 00:00:00 2001
2+
From: louislafosse <[email protected]>
3+
Date: Mon, 31 Mar 2025 20:48:52 +0200
4+
Subject: [PATCH] fix(null) : improve error handlings when passing a null
5+
pointer to some functions from lz4frame
6+
7+
Signed-off-by: Azure Linux Security Servicing Account <[email protected]>
8+
Upstream-reference: https://github.com/lz4/lz4/pull/1593.patch
9+
---
10+
lib/lz4frame.c | 15 +++++++++++++--
11+
tests/frametest.c | 9 ++++++---
12+
2 files changed, 19 insertions(+), 5 deletions(-)
13+
14+
diff --git a/lib/lz4frame.c b/lib/lz4frame.c
15+
index 174f9ae..cc6ed6f 100644
16+
--- a/lib/lz4frame.c
17+
+++ b/lib/lz4frame.c
18+
@@ -530,9 +530,16 @@ LZ4F_CDict*
19+
LZ4F_createCDict_advanced(LZ4F_CustomMem cmem, const void* dictBuffer, size_t dictSize)
20+
{
21+
const char* dictStart = (const char*)dictBuffer;
22+
- LZ4F_CDict* const cdict = (LZ4F_CDict*)LZ4F_malloc(sizeof(*cdict), cmem);
23+
+ LZ4F_CDict* cdict = NULL;
24+
+
25+
DEBUGLOG(4, "LZ4F_createCDict_advanced");
26+
- if (!cdict) return NULL;
27+
+
28+
+ if (!dictStart)
29+
+ return NULL;
30+
+ cdict = (LZ4F_CDict*)LZ4F_malloc(sizeof(*cdict), cmem);
31+
+ if (!cdict)
32+
+ return NULL;
33+
+
34+
cdict->cmem = cmem;
35+
if (dictSize > 64 KB) {
36+
dictStart += dictSize - 64 KB;
37+
@@ -1429,6 +1436,10 @@ LZ4F_errorCode_t LZ4F_getFrameInfo(LZ4F_dctx* dctx,
38+
LZ4F_frameInfo_t* frameInfoPtr,
39+
const void* srcBuffer, size_t* srcSizePtr)
40+
{
41+
+ assert(dctx != NULL);
42+
+ RETURN_ERROR_IF(frameInfoPtr == NULL, parameter_null);
43+
+ RETURN_ERROR_IF(srcSizePtr == NULL, parameter_null);
44+
+
45+
LZ4F_STATIC_ASSERT(dstage_getFrameHeader < dstage_storeFrameHeader);
46+
if (dctx->dStage > dstage_storeFrameHeader) {
47+
/* frameInfo already decoded */
48+
diff --git a/tests/frametest.c b/tests/frametest.c
49+
index 3301955..523e35d 100644
50+
--- a/tests/frametest.c
51+
+++ b/tests/frametest.c
52+
@@ -589,10 +589,13 @@ int basicTests(U32 seed, double compressibility)
53+
size_t const srcSize = 65 KB; /* must be > 64 KB to avoid short-size optimizations */
54+
size_t const dstCapacity = LZ4F_compressFrameBound(srcSize, NULL);
55+
size_t cSizeNoDict, cSizeWithDict;
56+
- LZ4F_CDict* const cdict = LZ4F_createCDict(CNBuffer, dictSize);
57+
- if (cdict == NULL) goto _output_error;
58+
- CHECK( LZ4F_createCompressionContext(&cctx, LZ4F_VERSION) );
59+
+ LZ4F_CDict* cdict = NULL;
60+
61+
+ CHECK( LZ4F_createCompressionContext(&cctx, LZ4F_VERSION) );
62+
+ cdict = LZ4F_createCDict(CNBuffer, dictSize);
63+
+ if (cdict == NULL)
64+
+ goto _output_error;
65+
+
66+
DISPLAYLEVEL(3, "Testing LZ4F_createCDict_advanced : ");
67+
{ LZ4F_CDict* const cda = LZ4F_createCDict_advanced(lz4f_cmem_test, CNBuffer, dictSize);
68+
if (cda == NULL) goto _output_error;
69+
--
70+
2.45.4
71+

SPECS/lz4/lz4.spec

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
Summary: Extremely fast compression.
22
Name: lz4
33
Version: 1.9.4
4-
Release: 1%{?dist}
4+
Release: 2%{?dist}
55
License: BSD 2-Clause and GPLv2
66
Vendor: Microsoft Corporation
77
Distribution: Azure Linux
@@ -14,7 +14,8 @@ Source0: https://github.com/lz4/lz4/archive/v%{version}/%{name}-%{version
1414
# *** NOTE: Leave this patch definition because the CVE Scan tool will flag the
1515
# CVE due to the above version format change.
1616
# CVE-2014-4715 applies to versions r* before r119.
17-
Patch0: CVE-2014-4715.nopatch
17+
# Patch0: CVE-2014-4715.nopatch
18+
Patch1: CVE-2025-62813.patch
1819

1920
%description
2021
LZ4 is lossless compression algorithm, providing compression speed at 400 MB/s per core, scalable with multi-cores CPU.
@@ -28,7 +29,7 @@ Requires: %{name} = %{version}-%{release}
2829
Static libraries and header files for the support library for lz4.
2930

3031
%prep
31-
%setup -q
32+
%autosetup -p1
3233

3334
%build
3435
make %{?_smp_mflags} all
@@ -56,6 +57,9 @@ make install DESTDIR=%{buildroot} LIBDIR=%{_libdir} PREFIX=%{_prefix}
5657
%{_includedir}/*
5758

5859
%changelog
60+
* Thu Oct 23 2025 Azure Linux Security Servicing Account <[email protected]> - 1.9.4-2
61+
- Patch for CVE-2025-62813
62+
5963
* Tue Nov 21 2023 CBL-Mariner Servicing Account <[email protected]> - 1.9.4-1
6064
- Auto-upgrade to 1.9.4 - Azure Linux 3.0 - package upgrades
6165

@@ -66,7 +70,7 @@ make install DESTDIR=%{buildroot} LIBDIR=%{_libdir} PREFIX=%{_prefix}
6670
* Fri Jun 12 2020 Eric Li <[email protected]> 1.9.2-2
6771
- Mark CVE-2014-4715 as not applicable due to version format change
6872

69-
* Tue May 18 2020 Andrew Phelps <[email protected]> 1.9.2-1
73+
* Mon May 18 2020 Andrew Phelps <[email protected]> 1.9.2-1
7074
- Update to version 1.9.2
7175

7276
* Sat May 09 2020 Nick Samson <[email protected]> 1.8.2-3

toolkit/resources/manifests/package/toolchain_aarch64.txt

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -255,9 +255,9 @@ lua-libs-5.4.6-1.azl3.aarch64.rpm
255255
lua-rpm-macros-1-6.azl3.noarch.rpm
256256
lua-srpm-macros-1-6.azl3.noarch.rpm
257257
lua-static-5.4.6-1.azl3.aarch64.rpm
258-
lz4-1.9.4-1.azl3.aarch64.rpm
259-
lz4-debuginfo-1.9.4-1.azl3.aarch64.rpm
260-
lz4-devel-1.9.4-1.azl3.aarch64.rpm
258+
lz4-1.9.4-2.azl3.aarch64.rpm
259+
lz4-debuginfo-1.9.4-2.azl3.aarch64.rpm
260+
lz4-devel-1.9.4-2.azl3.aarch64.rpm
261261
m4-1.4.19-2.azl3.aarch64.rpm
262262
m4-debuginfo-1.4.19-2.azl3.aarch64.rpm
263263
make-4.4.1-2.azl3.aarch64.rpm

toolkit/resources/manifests/package/toolchain_x86_64.txt

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -263,9 +263,9 @@ lua-libs-5.4.6-1.azl3.x86_64.rpm
263263
lua-rpm-macros-1-6.azl3.noarch.rpm
264264
lua-srpm-macros-1-6.azl3.noarch.rpm
265265
lua-static-5.4.6-1.azl3.x86_64.rpm
266-
lz4-1.9.4-1.azl3.x86_64.rpm
267-
lz4-debuginfo-1.9.4-1.azl3.x86_64.rpm
268-
lz4-devel-1.9.4-1.azl3.x86_64.rpm
266+
lz4-1.9.4-2.azl3.x86_64.rpm
267+
lz4-debuginfo-1.9.4-2.azl3.x86_64.rpm
268+
lz4-devel-1.9.4-2.azl3.x86_64.rpm
269269
m4-1.4.19-2.azl3.x86_64.rpm
270270
m4-debuginfo-1.4.19-2.azl3.x86_64.rpm
271271
make-4.4.1-2.azl3.x86_64.rpm

0 commit comments

Comments
 (0)