Unitialized memory read in ZSTD_decodeSeqHeaders()

Caused by two things:
1. Not checking that `ip` is in range except for the first byte.
2. `ZSTDv0{5,6}_decodeLiteralsBlock()` could return a value larger than `srcSize`.
This commit is contained in:
Nick Terrell committed 2016-10-18 16:41:33 -07:00
1 parent 7b06ad7a05
commit bb68062c59
5 files changed
+25 -7

No files matched your search

+1
View File
@@ -1536,6 +1536,7 @@ size_t ZSTDv01_decodeLiteralsBlock(void* ctx,
{
size_t rleSize = litbp.origSize;
if (rleSize>maxDstSize) return ERROR(dstSize_tooSmall);
if (!srcSize) return ERROR(srcSize_wrong);
memset(oend - rleSize, *ip, rleSize);
*litStart = oend - rleSize;
*litSize = rleSize;