sharpetronics/zstd
1
0
Fork 0
mirror of https://github.com/facebook/zstd.git synced 2025-12-08 00:03:24 -05:00
Code Issues Projects Releases Wiki Activity

fixed hang bug (infinite loop) in decoder, buffered mode, malicious input

Browse Source
This commit is contained in:
Yann Collet 2015-11-26 22:39:29 +01:00
parent cc30af6f76
commit d248aa1c62
1 changed files with 4 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
lib/zstd_buffered.c
View File

@ -260,7 +260,7 @@ size_t ZBUFF_compressContinue(ZBUFF_CCtx* zbc,
size_t ZBUFF_compressFlush(ZBUFF_CCtx* zbc, void* dst, size_t* maxDstSizePtr) size_t ZBUFF_compressFlush(ZBUFF_CCtx* zbc, void* dst, size_t* maxDstSizePtr)
{ {
size_t srcSize = 0; size_t srcSize = 0;
ZBUFF_compressContinue_generic(zbc, dst, maxDstSizePtr, &srcSize, &srcSize, 1); ZBUFF_compressContinue_generic(zbc, dst, maxDstSizePtr, &srcSize, &srcSize, 1); /* use a valid src address instead of NULL, as some sanitizer don't like it */
return zbc->outBuffContentSize - zbc->outBuffFlushedSize; return zbc->outBuffContentSize - zbc->outBuffFlushedSize;
} }
@ -511,7 +511,10 @@ size_t ZBUFF_decompressContinue(ZBUFF_DCtx* zbc, void* dst, size_t* maxDstSizePt
zbc->stage = ZBUFFds_read; zbc->stage = ZBUFFds_read;
if (zbc->outStart + BLOCKSIZE > zbc->outBuffSize) if (zbc->outStart + BLOCKSIZE > zbc->outBuffSize)
zbc->outStart = zbc->outEnd = 0; zbc->outStart = zbc->outEnd = 0;
break;
} }
/* cannot flush everything */
notDone = 0;
break; break;
} }
} }