Unitialized memory read in ZSTD_decodeSeqHeaders()

Caused by two things:
1. Not checking that `ip` is in range except for the first byte.
2. `ZSTDv0{5,6}_decodeLiteralsBlock()` could return a value larger than `srcSize`.
This commit is contained in:
Nick Terrell
2016-10-18 16:41:33 -07:00
parent 7b06ad7a05
commit bb68062c59
5 changed files with 25 additions and 7 deletions
+1
View File
@@ -1536,6 +1536,7 @@ size_t ZSTDv01_decodeLiteralsBlock(void* ctx,
{
size_t rleSize = litbp.origSize;
if (rleSize>maxDstSize) return ERROR(dstSize_tooSmall);
if (!srcSize) return ERROR(srcSize_wrong);
memset(oend - rleSize, *ip, rleSize);
*litStart = oend - rleSize;
*litSize = rleSize;