DragonFlyBSD Kernel Audit
DF-0267 / fix.diff
← back to finding ↓ download raw
diff --git a/sys/net/zlib.c b/sys/net/zlib.c
--- a/sys/net/zlib.c
+++ b/sys/net/zlib.c
@@ -4493,7 +4493,7 @@
 
 
 /* build fixed tables only once--keep them here */
-local int fixed_built = 0;
+local volatile int fixed_built = 0;
 #define FIXEDH 530      /* number of hufts used by fixed tables */
 local inflate_huft fixed_mem[FIXEDH];
 local uInt fixed_bl;
@@ -4527,7 +4527,13 @@
 inflate_trees_fixed(uIntf *bl, uIntf *bd, inflate_huft * FAR *tl,
 		    inflate_huft * FAR *td)
 {
-  /* build fixed tables if not already (multiple overlapped executions ok) */
+  /*
+   * build fixed tables if not already.  NOTE: overlapped executions are
+   * NOT ok -- they corrupt the shared fixed_mem[] via the shared 'f' huft
+   * counter. Callers (the net stack) currently serialize this; a full fix
+   * should build the fixed Huffman tables once at boot. fixed_built is marked
+   * volatile to avoid re-ordering of the check vs. the build.
+   */
   if (!fixed_built)
   {
     int k;              /* temporary variable */