ddidderr/zstd-rs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge pull request #2850 from felixhandte/oss-fuzz-fix-40829-for-real-this-time

Browse Source 
Fix Determinism Bug: Avoid Reducing Indices to Reserved Values
This commit is contained in:
Felix Handte
2021-11-10 12:00:43 -05:00
committed by GitHub
parent 931778ed9b 48572f52b1
commit a071e00696
1 changed files with 12 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
lib/compress/zstd_compress.c
+12 -5
View File
@@ -2311,6 +2311,8 @@ ZSTD_reduceTable_internal (U32* const table, U32 const size, U32 const reducerVa
int const nbRows = (int)size / ZSTD_ROWSIZE; int const nbRows = (int)size / ZSTD_ROWSIZE;
int cellNb = 0; int cellNb = 0;
int rowNb; int rowNb;
/* Protect special index values < ZSTD_WINDOW_START_INDEX. */
U32 const reducerThreshold = reducerValue + ZSTD_WINDOW_START_INDEX;
assert((size & (ZSTD_ROWSIZE-1)) == 0); /* multiple of ZSTD_ROWSIZE */ assert((size & (ZSTD_ROWSIZE-1)) == 0); /* multiple of ZSTD_ROWSIZE */
assert(size < (1U<<31)); /* can be casted to int */ assert(size < (1U<<31)); /* can be casted to int */
@@ -2330,12 +2332,17 @@ ZSTD_reduceTable_internal (U32* const table, U32 const size, U32 const reducerVa
for (rowNb=0 ; rowNb < nbRows ; rowNb++) { for (rowNb=0 ; rowNb < nbRows ; rowNb++) {
int column; int column;
for (column=0; column<ZSTD_ROWSIZE; column++) { for (column=0; column<ZSTD_ROWSIZE; column++) {
if (preserveMark) { U32 newVal;
U32 const adder = (table[cellNb] == ZSTD_DUBT_UNSORTED_MARK) ? reducerValue : 0; if (preserveMark && table[cellNb] == ZSTD_DUBT_UNSORTED_MARK) {
table[cellNb] += adder; /* This write is pointless, but is required(?) for the compiler
* to auto-vectorize the loop. */
newVal = ZSTD_DUBT_UNSORTED_MARK;
} else if (table[cellNb] < reducerThreshold) {
newVal = 0;
} else {
newVal = table[cellNb] - reducerValue;
} }
if (table[cellNb] < reducerValue) table[cellNb] = 0; table[cellNb] = newVal;
else table[cellNb] -= reducerValue;
cellNb++; cellNb++;
} } } }
} }