Vendored LZ4 is upstream r97 (2013) — 13 years of upstream hardening absent (cross-reference; upstream-owned history)
| Field | Value |
|---|---|
| ID | DF-2665 |
| Status | new |
| Severity | Info |
| CVSS 3.1 | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:N |
| CWE | CWE-1104 Use of Unmaintained Third Party Components |
| File | sys/vfs/hammer2/hammer2_lz4.c |
| Lines | 372-517 (decoder = verbatim r97), encoder header r96-era |
| Area | vfs |
| Confidence | certain |
| Discovered | 2026-08-29 |
| Pass | 2 (GLM 5.3 second pass) |
| Bucket | hammer2 |
| Reported | pending |
| Known CVE | CVE-2014-4610 (structurally unreachable: 32-bit only; sys/platform has only pc64/vkernel64) |
| CVE match | variant |
Summary
Version pinning: the decompressor in hammer2_lz4.c:372-517 is a verbatim
logic copy of upstream LZ4 r97 (svn trunk@97, 2013-06-10 — imported for
hammer2 the same day); the encoder header matches r96-era. Never
re-synced. Missing upstream changes assessed for this tree: (1)
CVE-2014-4610 fix (r118) — 32-bit only, structurally unreachable on
DragonFly's LP64-only platforms; (2) r110+ empty-block special case and
later bounded readers with explicit overflow detection — LP64 safety
already provided by the existing margin discipline (fuzz-confirmed);
(3) v1.9.4's srcSize==0 guard — the one fix that matters even on
LP64, missing here (filed as DF-2664); (4) r116+ table reorganization —
equivalent semantics on x86-64; (5) FAST_DEC_LOOP / streaming APIs —
performance/features.
Threat
No incremental exposure on LP64 beyond DF-2664; forward-looking risk (future refactors or new callers inherit un-audited 2013 parsing code; any future 32-bit port would acquire CVE-2014-4610).
Recommended fix
Re-vendor the current upstream lz4.c decompression core (v1.9.4+) or
cherry-pick the two post-r97 safety guards (the inputSize==0 guard —
already in DF-2664's fix.diff — and the literal/match-length overflow
checks). Track upstream LZ4 advisories for the vendored copy as done
for sys/contrib/.
Timeline
- 2026-08-29 Recorded during pass-2 audit of hammer2_lz4.c (GLM 5.3).
No comments yet.