diff options
| author | Arne Schwabe <arne@rfc2549.org> | 2014-06-29 18:18:50 +0200 |
|---|---|---|
| committer | Arne Schwabe <arne@rfc2549.org> | 2014-06-29 18:18:50 +0200 |
| commit | 68e19d426ba6d9f048ebfdf337b93a85dc4d5b4c (patch) | |
| tree | cb33b2698e3f665546a328882c7481b11f633428 /main/lzo/NEWS | |
| parent | d3aa9f835d7fd5f53d3a0da6778d46a7067bf074 (diff) | |
Update lzo version
--HG--
extra : rebase_source : 4310223035376c8ac1773fd03a43289aa96ce4f3
Diffstat (limited to 'main/lzo/NEWS')
| -rw-r--r-- | main/lzo/NEWS | 16 |
1 files changed, 16 insertions, 0 deletions
diff --git a/main/lzo/NEWS b/main/lzo/NEWS index 15eedeff..103c4d87 100644 --- a/main/lzo/NEWS +++ b/main/lzo/NEWS @@ -2,6 +2,22 @@ User visible changes for LZO -- a real-time data compression library ============================================================================ +Changes in 2.07 (25 Jun 2014) + * Fixed a potential integer overflow condition in the "safe" decompressor + variants which could result in a possible buffer overrun when + processing maliciously crafted compressed input data. + + As this issue only affects 32-bit systems and also can only happen if + you use uncommonly huge buffer sizes where you have to decompress more + than 16 MiB (2^24 bytes) compressed bytes within a single function call, + the practical implications are limited. + + POTENTIAL SECURITY ISSUE. + + * Removed support for ancient configurations like 16-bit "huge" pointers - + LZO now requires a flat 32-bit or 64-bit memory model. + * Assorted cleanups. + Changes in 2.06 (12 Aug 2011) * Some minor optimizations for big-endian architectures. * Fixed overly strict malloc() misalignment check in examples. |