| author |  Dominic <4678790+dweiller@users.noreply.github.com> 2023-02-13 18:02:25+11:00 |
| committer | Dominic <4678790+dweiller@users.noreply.github.com> 2023-02-20 09:09:06+11:00 |
| log | 1a862175d52eb35efd7ecb368c1806b4ac1e7886 |
| tree | 836eb01cfa9e640f282bb8e1e60b344577fe9985 |
| parent | 12aa478db08c5652d27228183bb898f65db7a2ae |
std.compress.zstandard: fix zstandardStream content size validation
2 files changed, 13 insertions(+), 4 deletions(-)
lib- std
- compress
- zstandard.zig
- zstandard
lib/std/compress/zstandard.zig+7-2
| ... | ... | @@ -177,9 +177,14 @@ pub fn ZstandardStream( |
| 177 | 177 | ) catch |
| 178 | 178 | return error.MalformedBlock; |
| 179 | 179 | |
| 180 | if (self.frame_context.content_size) |size| { | |
| 181 | if (self.current_frame_decompressed_size > size) return error.MalformedFrame; | |
| 182 | } | |
| 183 | ||
| 184 | const size = self.buffer.len(); | |
| 185 | self.current_frame_decompressed_size += size; | |
| 186 | ||
| 180 | 187 | if (self.frame_context.hasher_opt) |*hasher| { |
| 181 | const size = self.buffer.len(); | |
| 182 | self.current_frame_decompressed_size += size; | |
| 183 | 188 | if (size > 0) { |
| 184 | 189 | const written_slice = self.buffer.sliceLast(size); |
| 185 | 190 | hasher.update(written_slice.first); |
lib/std/compress/zstandard/decompress.zig+6-2
| ... | ... | @@ -497,6 +497,11 @@ pub fn decodeZstandardFrameBlocksArrayList( |
| 497 | 497 | &consumed_count, |
| 498 | 498 | frame_context.block_size_max, |
| 499 | 499 | ); |
| 500 | if (frame_context.content_size) |size| { | |
| 501 | if (dest.items.len - initial_len > size) { | |
| 502 | return error.BadContentSize; | |
| 503 | } | |
| 504 | } | |
| 500 | 505 | if (written_size > 0) { |
| 501 | 506 | const written_slice = ring_buffer.sliceLast(written_size); |
| 502 | 507 | try dest.appendSlice(written_slice.first); |
| ... | ... | @@ -508,9 +513,8 @@ pub fn decodeZstandardFrameBlocksArrayList( |
| 508 | 513 | } |
| 509 | 514 | if (block_header.last_block) break; |
| 510 | 515 | } |
| 511 | const added_len = dest.items.len - initial_len; | |
| 512 | 516 | if (frame_context.content_size) |size| { |
| 513 | if (added_len != size) { | |
| 517 | if (dest.items.len - initial_len != size) { | |
| 514 | 518 | return error.BadContentSize; |
| 515 | 519 | } |
| 516 | 520 | } |