mirror of
https://github.com/facebook/zstd.git
synced 2025-10-08 00:04:02 -04:00
When we switched `ZSTD_SKIPPABLEHEADERSIZE` to a macro, the places where we do: MEM_readLE32(ptr) + ZSTD_SKIPPABLEHEADERSIZE can now overflow `(unsigned)-8` to `0` and we infinite loop. We now check the frame size and reject sizes that overflow a U32. Note that this bug never made it into a release, and was only in the dev branch for a few days. Credit to OSS-Fuzz