Re: LMS-2014-06-16-1: Oberhumer LZO

[Yves-Alexis Perez <corsac () debian org>]

On ven., 2014-06-27 at 14:46 -0700, H. Peter Anvin wrote:
> On 06/26/2014 02:21 PM, Yves-Alexis Perez wrote:
> > - syslinux [5] seems to embeds lzo but I'm unsure if the vulnerable
> > code is really present, I can't find lzo1x_decompress_safe() code
>
> For the record, I just upgraded Syslinux to LZO 2.07.  The only code
> that ends up in the Syslinux build at all changed only in comments and
> in #if'd out code. 

Thanks for the investigation. Is there a reason not to link with lzo
instead of embedding it?

>  The only use of LZO is in the Syslinux core, which
> uses the assembly LZO implementation, which seems to have been unaffected.

Good point, my searches indeed usually don't include any non-C
implementation, which might or might not be affected.
> Syslinux does not use LZO on arbitrary data.

Thanks, so that's three reasons syslinux itself is not affected:

- embedded LZO didn't contain the affected code;
- syslinux core LZO assembly implementation is not touched;
- LZO is done only on controlled data (not under anyone control?)

Regards,
-- 
Yves-Alexis

Attachment: signature.asc
Description: This is a digitally signed message part