Unitialized memory read in ZSTD_decodeSeqHeaders()
Caused by two things:
1. Not checking that `ip` is in range except for the first byte.
2. `ZSTDv0{5,6}_decodeLiteralsBlock()` could return a value larger than `srcSize`.
This commit is contained in:
@@ -1536,6 +1536,7 @@ size_t ZSTDv01_decodeLiteralsBlock(void* ctx,
|
||||
{
|
||||
size_t rleSize = litbp.origSize;
|
||||
if (rleSize>maxDstSize) return ERROR(dstSize_tooSmall);
|
||||
if (!srcSize) return ERROR(srcSize_wrong);
|
||||
memset(oend - rleSize, *ip, rleSize);
|
||||
*litStart = oend - rleSize;
|
||||
*litSize = rleSize;
|
||||
|
||||
Reference in New Issue
Block a user