authorgravatar for squeek502@hotmail.comRyan Liptak <squeek502@hotmail.com> 2025-08-15 17:38:13-07:00
committergravatar for andrew@ziglang.orgAndrew Kelley <andrew@ziglang.org> 2025-08-15 22:11:51-07:00
log98547713a354efef406ca79731db8984eb26c051
treed0af6057b62cfc741d8d9313ac7e67e2abcde1d8
parentee85c8b6d05dbda541d4b0b8b402aafad8e582a3

zstd: Protect against index out-of-bounds when decoding sequences

Previously, index out-of-bounds could occur when copying match_length bytes while decoding whatever sequence happened to overflow `dest`. Now, each sequence checks that there is enough room for the full sequence_length (literal_length + match_length) before doing any copying. Fixes the failing inputs found here: https://github.com/ziglang/zig/issues/24817#issuecomment-3192927715

1 files changed, 3 insertions(+), 0 deletions(-)

lib/std/compress/zstd/Decompress.zig+3
...@@ -765,6 +765,9 @@ pub const Frame = struct {...@@ -765,6 +765,9 @@ pub const Frame = struct {
765 const match_length: usize = sequence.match_length;765 const match_length: usize = sequence.match_length;
766 const sequence_length = literal_length + match_length;766 const sequence_length = literal_length + match_length;
767767
768 if (sequence_length > dest[write_pos..].len)
769 return error.MalformedSequence;
770
768 const copy_start = std.math.sub(usize, write_pos + sequence.literal_length, sequence.offset) catch771 const copy_start = std.math.sub(usize, write_pos + sequence.literal_length, sequence.offset) catch
769 return error.MalformedSequence;772 return error.MalformedSequence;
770773