Skip to content

Commit f4240e2

Browse files
azurelinux-securityazurelinux-security
committed
Patch lz4 for CVE-2025-62813 
1 parent 3ca8a2a commit f4240e2

File tree

4 files changed

+83
-7
lines changed

4 files changed

+83
-7
lines changed

‎SPECS/lz4/CVE-2025-62813.patch‎

Lines changed: 71 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,71 @@
1+
From 6c8135e4bae6c1a4f1e20019159f596ee2e8ae2a Mon Sep 17 00:00:00 2001
2+
From: louislafosse <[email protected]>
3+
Date: Mon, 31 Mar 2025 20:48:52 +0200
4+
Subject: [PATCH] fix(null) : improve error handlings when passing a null
5+
pointer to some functions from lz4frame
6+
7+
Signed-off-by: Azure Linux Security Servicing Account <[email protected]>
8+
Upstream-reference: https://github.com/lz4/lz4/pull/1593.patch
9+
---
10+
lib/lz4frame.c | 15 +++++++++++++--
11+
tests/frametest.c | 9 ++++++---
12+
2 files changed, 19 insertions(+), 5 deletions(-)
13+
14+
diff --git a/lib/lz4frame.c b/lib/lz4frame.c
15+
index 174f9ae..cc6ed6f 100644
16+
--- a/lib/lz4frame.c
17+
+++ b/lib/lz4frame.c
18+
@@ -530,9 +530,16 @@ LZ4F_CDict*
19+
LZ4F_createCDict_advanced(LZ4F_CustomMem cmem, const void* dictBuffer, size_t dictSize)
20+
{
21+
const char* dictStart = (const char*)dictBuffer;
22+
- LZ4F_CDict* const cdict = (LZ4F_CDict*)LZ4F_malloc(sizeof(*cdict), cmem);
23+
+ LZ4F_CDict* cdict = NULL;
24+
+
25+
DEBUGLOG(4, "LZ4F_createCDict_advanced");
26+
- if (!cdict) return NULL;
27+
+
28+
+ if (!dictStart)
29+
+ return NULL;
30+
+ cdict = (LZ4F_CDict*)LZ4F_malloc(sizeof(*cdict), cmem);
31+
+ if (!cdict)
32+
+ return NULL;
33+
+
34+
cdict->cmem = cmem;
35+
if (dictSize > 64 KB) {
36+
dictStart += dictSize - 64 KB;
37+
@@ -1429,6 +1436,10 @@ LZ4F_errorCode_t LZ4F_getFrameInfo(LZ4F_dctx* dctx,
38+
LZ4F_frameInfo_t* frameInfoPtr,
39+
const void* srcBuffer, size_t* srcSizePtr)
40+
{
41+
+ assert(dctx != NULL);
42+
+ RETURN_ERROR_IF(frameInfoPtr == NULL, parameter_null);
43+
+ RETURN_ERROR_IF(srcSizePtr == NULL, parameter_null);
44+
+
45+
LZ4F_STATIC_ASSERT(dstage_getFrameHeader < dstage_storeFrameHeader);
46+
if (dctx->dStage > dstage_storeFrameHeader) {
47+
/* frameInfo already decoded */
48+
diff --git a/tests/frametest.c b/tests/frametest.c
49+
index 3301955..523e35d 100644
50+
--- a/tests/frametest.c
51+
+++ b/tests/frametest.c
52+
@@ -589,10 +589,13 @@ int basicTests(U32 seed, double compressibility)
53+
size_t const srcSize = 65 KB; /* must be > 64 KB to avoid short-size optimizations */
54+
size_t const dstCapacity = LZ4F_compressFrameBound(srcSize, NULL);
55+
size_t cSizeNoDict, cSizeWithDict;
56+
- LZ4F_CDict* const cdict = LZ4F_createCDict(CNBuffer, dictSize);
57+
- if (cdict == NULL) goto _output_error;
58+
- CHECK( LZ4F_createCompressionContext(&cctx, LZ4F_VERSION) );
59+
+ LZ4F_CDict* cdict = NULL;
60+
61+
+ CHECK( LZ4F_createCompressionContext(&cctx, LZ4F_VERSION) );
62+
+ cdict = LZ4F_createCDict(CNBuffer, dictSize);
63+
+ if (cdict == NULL)
64+
+ goto _output_error;
65+
+
66+
DISPLAYLEVEL(3, "Testing LZ4F_createCDict_advanced : ");
67+
{ LZ4F_CDict* const cda = LZ4F_createCDict_advanced(lz4f_cmem_test, CNBuffer, dictSize);
68+
if (cda == NULL) goto _output_error;
69+
--
70+
2.45.4
71+

‎SPECS/lz4/lz4.spec‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
Summary: Extremely fast compression.
22
Name: lz4
33
Version: 1.9.4
4-
Release: 1%{?dist}
4+
Release: 2%{?dist}
55
License: BSD 2-Clause and GPLv2
66
Vendor: Microsoft Corporation
77
Distribution: Mariner
@@ -15,6 +15,7 @@ Source0: https://github.com/lz4/lz4/archive/v%{version}/%{name}-%{version
1515
# CVE due to the above version format change.
1616
# CVE-2014-4715 applies to versions r* before r119.
1717
Patch0: CVE-2014-4715.nopatch
18+
Patch1: CVE-2025-62813.patch
1819

1920
%description
2021
LZ4 is lossless compression algorithm, providing compression speed at 400 MB/s per core, scalable with multi-cores CPU.
@@ -29,6 +30,7 @@ Static libraries and header files for the support library for lz4.
2930

3031
%prep
3132
%setup -q
33+
%patch 1 -p1
3234

3335
%build
3436
make %{?_smp_mflags} all
@@ -56,6 +58,9 @@ make install DESTDIR=%{buildroot} LIBDIR=%{_libdir} PREFIX=%{_prefix}
5658
%{_includedir}/*
5759

5860
%changelog
61+
* Sat Oct 25 2025 Azure Linux Security Servicing Account <[email protected]> - 1.9.4-2
62+
- Patch for CVE-2025-62813
63+
5964
* Mon Feb 05 2024 Rohit Rawat <[email protected]> - 1.9.4-1
6065
- Upgrade to 1.9.4-1 to fix CVE-2021-3520
6166

‎toolkit/resources/manifests/package/toolchain_aarch64.txt‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -222,9 +222,9 @@ lua-libs-5.4.4-1.cm2.aarch64.rpm
222222
lua-rpm-macros-1-6.cm2.noarch.rpm
223223
lua-srpm-macros-1-6.cm2.noarch.rpm
224224
lua-static-5.4.4-1.cm2.aarch64.rpm
225-
lz4-1.9.4-1.cm2.aarch64.rpm
226-
lz4-debuginfo-1.9.4-1.cm2.aarch64.rpm
227-
lz4-devel-1.9.4-1.cm2.aarch64.rpm
225+
lz4-1.9.4-2.cm2.aarch64.rpm
226+
lz4-debuginfo-1.9.4-2.cm2.aarch64.rpm
227+
lz4-devel-1.9.4-2.cm2.aarch64.rpm
228228
m4-1.4.19-2.cm2.aarch64.rpm
229229
m4-debuginfo-1.4.19-2.cm2.aarch64.rpm
230230
make-4.3-3.cm2.aarch64.rpm

‎toolkit/resources/manifests/package/toolchain_x86_64.txt‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -228,9 +228,9 @@ lua-libs-5.4.4-1.cm2.x86_64.rpm
228228
lua-rpm-macros-1-6.cm2.noarch.rpm
229229
lua-srpm-macros-1-6.cm2.noarch.rpm
230230
lua-static-5.4.4-1.cm2.x86_64.rpm
231-
lz4-1.9.4-1.cm2.x86_64.rpm
232-
lz4-debuginfo-1.9.4-1.cm2.x86_64.rpm
233-
lz4-devel-1.9.4-1.cm2.x86_64.rpm
231+
lz4-1.9.4-2.cm2.x86_64.rpm
232+
lz4-debuginfo-1.9.4-2.cm2.x86_64.rpm
233+
lz4-devel-1.9.4-2.cm2.x86_64.rpm
234234
m4-1.4.19-2.cm2.x86_64.rpm
235235
m4-debuginfo-1.4.19-2.cm2.x86_64.rpm
236236
make-4.3-3.cm2.x86_64.rpm

0 commit comments

Comments
 (0)