From a42bbb4e058063be8b61b3e00306eb6fb886a836 Mon Sep 17 00:00:00 2001 From: "W. Felix Handte" Date: Thu, 15 Aug 2019 14:24:45 -0400 Subject: [PATCH 1/2] Fix Buffer Overflow in Legacy (v0.3) Raw Literals Decompression --- lib/legacy/zstd_v03.c | 1 + 1 file changed, 1 insertion(+) diff --git a/lib/legacy/zstd_v03.c b/lib/legacy/zstd_v03.c index 7a0e7c9b6..dbc83f1ee 100644 --- a/lib/legacy/zstd_v03.c +++ b/lib/legacy/zstd_v03.c @@ -2530,6 +2530,7 @@ static size_t ZSTD_decodeLiteralsBlock(void* ctx, const size_t litSize = (MEM_readLE32(istart) & 0xFFFFFF) >> 2; /* no buffer issue : srcSize >= MIN_CBLOCK_SIZE */ if (litSize > srcSize-11) /* risk of reading too far with wildcopy */ { + if (litSize > BLOCKSIZE) return ERROR(corruption_detected); if (litSize > srcSize-3) return ERROR(corruption_detected); memcpy(dctx->litBuffer, istart, litSize); dctx->litPtr = dctx->litBuffer; From d6f31e1c380badcd276acd6e722d3bd217149aab Mon Sep 17 00:00:00 2001 From: "W. Felix Handte" Date: Thu, 15 Aug 2019 14:42:38 -0400 Subject: [PATCH 2/2] Add to CHANGELOG for Upcoming Release --- CHANGELOG | 1 + 1 file changed, 1 insertion(+) diff --git a/CHANGELOG b/CHANGELOG index a94c090de..ae54896a9 100644 --- a/CHANGELOG +++ b/CHANGELOG @@ -1,5 +1,6 @@ v1.4.3 bug: Fix Dictionary Compression Ratio Regression by @cyan4973 (#1709) +bug: Fix Buffer Overflow in v0.3 Decompression by @felixhandte (#1722) build: Add support for IAR C/C++ Compiler for Arm by @joseph0918 (#1705) misc: Add NULL pointer check in util.c by @leeyoung624 (#1706)