ddidderr/zstd-rs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

rewrite legacy v0.7 bound checks to be independent of address space overflow

Browse Source
This commit is contained in:
Yann Collet
2023-02-07 17:11:07 -08:00
parent c5bf6b8b88
commit c689310b25
1 changed files with 7 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
lib/legacy/zstd_v07.c
+7 -4
View File
@@ -3552,11 +3552,14 @@ size_t ZSTDv07_execSequence(BYTE* op,
const BYTE* match = oLitEnd - sequence.offset; const BYTE* match = oLitEnd - sequence.offset;
/* check */ /* check */
if ((oLitEnd>oend_w) | (oMatchEnd>oend)) return ERROR(dstSize_tooSmall); /* last match must start at a minimum distance of WILDCOPY_OVERLENGTH from oend */ assert(oend >= op);
if (iLitEnd > litLimit) return ERROR(corruption_detected); /* over-read beyond lit buffer */ if (sequence.litLength + WILDCOPY_OVERLENGTH > (size_t)(oend - op)) return ERROR(dstSize_tooSmall);
if (sequenceLength > (size_t)(oend - op)) return ERROR(dstSize_tooSmall);
assert(litLimit >= *litPtr);
if (sequence.litLength > (size_t)(litLimit - *litPtr)) return ERROR(corruption_detected);;
/* copy Literals */ /* copy Literals */
ZSTDv07_wildcopy(op, *litPtr, sequence.litLength); /* note : since oLitEnd <= oend-WILDCOPY_OVERLENGTH, no risk of overwrite beyond oend */ ZSTDv07_wildcopy(op, *litPtr, (ptrdiff_t)sequence.litLength); /* note : since oLitEnd <= oend-WILDCOPY_OVERLENGTH, no risk of overwrite beyond oend */
op = oLitEnd; op = oLitEnd;
*litPtr = iLitEnd; /* update for next sequence */ *litPtr = iLitEnd; /* update for next sequence */
@@ -3570,7 +3573,7 @@ size_t ZSTDv07_execSequence(BYTE* op,
return sequenceLength; return sequenceLength;
} }
/* span extDict & currentPrefixSegment */ /* span extDict & currentPrefixSegment */
{ size_t const length1 = dictEnd - match; { size_t const length1 = (size_t)(dictEnd - match);
memmove(oLitEnd, match, length1); memmove(oLitEnd, match, length1);
op = oLitEnd + length1; op = oLitEnd + length1;
sequence.matchLength -= length1; sequence.matchLength -= length1;