Fix decompression buffer overrun

Allows an adversary to write up to 3 bytes beyond the end of the buffer. Occurs if the match overlaps the `extDict` and `currentPrefix`, and the match length in the `currentPrefix` is less than `MINMATCH`, and `op-(16-MINMATCH) >= oMatchEnd > op-16`.
2016-12-12 18:05:30 -08:00
parent 4c6ce5a57e
commit e474aa55b4
8 changed files with 13 additions and 13 deletions
@@ -1803,7 +1803,7 @@ static size_t ZSTD_execSequence(BYTE* op,
        } else { ZSTD_copy8(op, match); }
        op += 8; match += 8;

-        if (endMatch > oend-12)
+        if (endMatch > oend-(16-MINMATCH))
        {
            if (op < oend-8)
            {