[PATCH] lib/lzo: check output space before writing the RLE header

[Sean Snider]

The safe LZO-RLE compressor writes its two-byte version header before
checking the available output space. With an output capacity of zero or
one, these stores exceed the supplied limit. Advancing op past op_end
also makes the unsigned HAVE_OP() comparison accept later writes.

Check for the two header bytes before emitting them. Use the existing
output_overrun path, leaving the output length unchanged on this error.
Ordinary LZO does not emit this header. Valid output is unchanged.

Bounded userspace tests of the kernel codec under ASan/UBSan reproduced
the boundary violation and passed after the correction. Successful
full-capacity streams remained byte-identical, and the existing Crypto
LZO and LZO-RLE compression vectors passed.

Fixes: cc47f07234f7 ("crypto: lzo - Fix compression buffer overrun")
Assisted-by: LLM
Signed-off-by: Sean Snider <ssnider5@xxxxxxxxxxx>
---
 lib/lzo/lzo1x_compress.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/lib/lzo/lzo1x_compress.c b/lib/lzo/lzo1x_compress.c
index 01586af23..621bbb969 100644
--- a/lib/lzo/lzo1x_compress.c
+++ b/lib/lzo/lzo1x_compress.c
@@ -349,6 +349,7 @@ static int LZO_SAFE(lzogeneric1x_1_compress)(
 	// LZO v0 will never write 17 as first byte (except for zero-length
 	// input), so this is used to version the bitstream
 	if (bitstream_version > 0) {
+		NEED_OP(2);
 		*op++ = 17;
 		*op++ = bitstream_version;
 		m4_max_offset = M4_MAX_OFFSET_V1;
-- 
2.43.0