ddidderr/zstd-rs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge pull request #1722 from felixhandte/legacy-decompression-fix

Browse Source 
Fix Buffer Overflow in Legacy (v0.3) Raw Literals Decompression
This commit is contained in:
Felix Handte
2019-08-15 15:55:46 -04:00
committed by GitHub
parent 87e31223e8 d6f31e1c38
commit c9072ee674
2 changed files with 2 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
CHANGELOG
+1
View File
@@ -1,5 +1,6 @@
v1.4.3 v1.4.3
bug: Fix Dictionary Compression Ratio Regression by @cyan4973 (#1709) bug: Fix Dictionary Compression Ratio Regression by @cyan4973 (#1709)
bug: Fix Buffer Overflow in v0.3 Decompression by @felixhandte (#1722)
build: Add support for IAR C/C++ Compiler for Arm by @joseph0918 (#1705) build: Add support for IAR C/C++ Compiler for Arm by @joseph0918 (#1705)
misc: Add NULL pointer check in util.c by @leeyoung624 (#1706) misc: Add NULL pointer check in util.c by @leeyoung624 (#1706)
lib/legacy/zstd_v03.c
+1
View File
@@ -2530,6 +2530,7 @@ static size_t ZSTD_decodeLiteralsBlock(void* ctx,
const size_t litSize = (MEM_readLE32(istart) & 0xFFFFFF) >> 2; /* no buffer issue : srcSize >= MIN_CBLOCK_SIZE */ const size_t litSize = (MEM_readLE32(istart) & 0xFFFFFF) >> 2; /* no buffer issue : srcSize >= MIN_CBLOCK_SIZE */
if (litSize > srcSize-11) /* risk of reading too far with wildcopy */ if (litSize > srcSize-11) /* risk of reading too far with wildcopy */
{ {
if (litSize > BLOCKSIZE) return ERROR(corruption_detected);
if (litSize > srcSize-3) return ERROR(corruption_detected); if (litSize > srcSize-3) return ERROR(corruption_detected);
memcpy(dctx->litBuffer, istart, litSize); memcpy(dctx->litBuffer, istart, litSize);
dctx->litPtr = dctx->litBuffer; dctx->litPtr = dctx->litBuffer;