Fix decompression buffer overrun

Allows an adversary to write up to 3 bytes beyond the end of the buffer. Occurs if the match overlaps the `extDict` and `currentPrefix`, and the match length in the `currentPrefix` is less than `MINMATCH`, and `op-(16-MINMATCH) >= oMatchEnd > op-16`.
2016-12-12 18:05:30 -08:00
parent 4c6ce5a57e
commit e474aa55b4
8 changed files with 13 additions and 13 deletions
@@ -2847,7 +2847,7 @@ static size_t ZSTD_execSequence(BYTE* op,
        }
        op += 8; match += 8;

-        if (oMatchEnd > oend-12)
+        if (oMatchEnd > oend-(16-MINMATCH))
        {
            if (op < oend_8)
            {