From 823d8c233bd7a12aefee349d7556855ea3894487 Mon Sep 17 00:00:00 2001 From: Sean Purcell Date: Wed, 1 Feb 2017 10:41:04 -0800 Subject: [PATCH] Minor security fixes --- contrib/educational_decoder/harness.c | 2 +- contrib/educational_decoder/zstd_decompress.c | 2 ++ 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/contrib/educational_decoder/harness.c b/contrib/educational_decoder/harness.c index 107a16a22..cff8239d6 100644 --- a/contrib/educational_decoder/harness.c +++ b/contrib/educational_decoder/harness.c @@ -98,7 +98,7 @@ int main(int argc, char **argv) { } size_t decompressed = - ZSTD_decompress_with_dict(output, input_size * MAX_COMPRESSION_RATIO, + ZSTD_decompress_with_dict(output, decompressed_size, input, input_size, dict, dict_size); write_file(argv[2], output, decompressed); diff --git a/contrib/educational_decoder/zstd_decompress.c b/contrib/educational_decoder/zstd_decompress.c index 3c1c56730..e2fbcf2cf 100644 --- a/contrib/educational_decoder/zstd_decompress.c +++ b/contrib/educational_decoder/zstd_decompress.c @@ -1331,6 +1331,8 @@ static void execute_sequences(io_streams_t *const streams, } match_length -= dict_copy; } + } else if (offset > ctx->header.window_size) { + CORRUPTION(); } // We must copy byte by byte because the match length might be larger