@@ -1873,10 +1873,12 @@ static size_t HUFv05_readStats(BYTE* huffWeight, size_t hwSize, U32* rankStats,
1873
1873
U32 weightTotal ;
1874
1874
U32 tableLog ;
1875
1875
const BYTE * ip = (const BYTE * ) src ;
1876
- size_t iSize = ip [ 0 ] ;
1876
+ size_t iSize ;
1877
1877
size_t oSize ;
1878
1878
U32 n ;
1879
1879
1880
+ if (!srcSize ) return ERROR (srcSize_wrong );
1881
+ iSize = ip [0 ];
1880
1882
//memset(huffWeight, 0, hwSize); /* is not necessary, even though some analyzer complain ... */
1881
1883
1882
1884
if (iSize >= 128 ) { /* special header */
@@ -1910,6 +1912,7 @@ static size_t HUFv05_readStats(BYTE* huffWeight, size_t hwSize, U32* rankStats,
1910
1912
rankStats [huffWeight [n ]]++ ;
1911
1913
weightTotal += (1 << huffWeight [n ]) >> 1 ;
1912
1914
}
1915
+ if (weightTotal == 0 ) return ERROR (corruption_detected );
1913
1916
1914
1917
/* get last non-null symbol weight (implied, total must be 2^n) */
1915
1918
tableLog = BITv05_highbit32 (weightTotal ) + 1 ;
@@ -2943,6 +2946,7 @@ size_t ZSTDv05_decodeLiteralsBlock(ZSTDv05_DCtx* dctx,
2943
2946
{
2944
2947
size_t litSize , litCSize , singleStream = 0 ;
2945
2948
U32 lhSize = ((istart [0 ]) >> 4 ) & 3 ;
2949
+ if (srcSize < 5 ) return ERROR (corruption_detected ); /* srcSize >= MIN_CBLOCK_SIZE == 3; here we need up to 5 for case 3 */
2946
2950
switch (lhSize )
2947
2951
{
2948
2952
case 0 : case 1 : default : /* note : default is impossible, since lhSize into [0..3] */
@@ -2966,6 +2970,7 @@ size_t ZSTDv05_decodeLiteralsBlock(ZSTDv05_DCtx* dctx,
2966
2970
break ;
2967
2971
}
2968
2972
if (litSize > BLOCKSIZE ) return ERROR (corruption_detected );
2973
+ if (litCSize + lhSize > srcSize ) return ERROR (corruption_detected );
2969
2974
2970
2975
if (HUFv05_isError (singleStream ?
2971
2976
HUFv05_decompress1X2 (dctx -> litBuffer , litSize , istart + lhSize , litCSize ) :
@@ -2991,6 +2996,7 @@ size_t ZSTDv05_decodeLiteralsBlock(ZSTDv05_DCtx* dctx,
2991
2996
lhSize = 3 ;
2992
2997
litSize = ((istart [0 ] & 15 ) << 6 ) + (istart [1 ] >> 2 );
2993
2998
litCSize = ((istart [1 ] & 3 ) << 8 ) + istart [2 ];
2999
+ if (litCSize + litSize > srcSize ) return ERROR (corruption_detected );
2994
3000
2995
3001
errorCode = HUFv05_decompress1X4_usingDTable (dctx -> litBuffer , litSize , istart + lhSize , litCSize , dctx -> hufTableX4 );
2996
3002
if (HUFv05_isError (errorCode )) return ERROR (corruption_detected );
@@ -3047,6 +3053,7 @@ size_t ZSTDv05_decodeLiteralsBlock(ZSTDv05_DCtx* dctx,
3047
3053
break ;
3048
3054
case 3 :
3049
3055
litSize = ((istart [0 ] & 15 ) << 16 ) + (istart [1 ] << 8 ) + istart [2 ];
3056
+ if (srcSize < 4 ) return ERROR (corruption_detected ); /* srcSize >= MIN_CBLOCK_SIZE == 3; here we need lhSize+1 = 4 */
3050
3057
break ;
3051
3058
}
3052
3059
if (litSize > BLOCKSIZE ) return ERROR (corruption_detected );
@@ -3080,17 +3087,22 @@ size_t ZSTDv05_decodeSeqHeaders(int* nbSeq, const BYTE** dumpsPtr, size_t* dumps
3080
3087
/* SeqHead */
3081
3088
* nbSeq = * ip ++ ;
3082
3089
if (* nbSeq == 0 ) return 1 ;
3083
- if (* nbSeq >= 128 )
3090
+ if (* nbSeq >= 128 ) {
3091
+ if (ip >= iend ) return ERROR (srcSize_wrong );
3084
3092
* nbSeq = ((nbSeq [0 ]- 128 )<<8 ) + * ip ++ ;
3093
+ }
3085
3094
3095
+ if (ip >= iend ) return ERROR (srcSize_wrong );
3086
3096
LLtype = * ip >> 6 ;
3087
3097
Offtype = (* ip >> 4 ) & 3 ;
3088
3098
MLtype = (* ip >> 2 ) & 3 ;
3089
3099
if (* ip & 2 ) {
3100
+ if (ip + 3 > iend ) return ERROR (srcSize_wrong );
3090
3101
dumpsLength = ip [2 ];
3091
3102
dumpsLength += ip [1 ] << 8 ;
3092
3103
ip += 3 ;
3093
3104
} else {
3105
+ if (ip + 2 > iend ) return ERROR (srcSize_wrong );
3094
3106
dumpsLength = ip [1 ];
3095
3107
dumpsLength += (ip [0 ] & 1 ) << 8 ;
3096
3108
ip += 2 ;
@@ -3669,11 +3681,11 @@ static size_t ZSTDv05_loadEntropy(ZSTDv05_DCtx* dctx, const void* dict, size_t d
3669
3681
{
3670
3682
size_t hSize , offcodeHeaderSize , matchlengthHeaderSize , errorCode , litlengthHeaderSize ;
3671
3683
short offcodeNCount [MaxOff + 1 ];
3672
- U32 offcodeMaxValue = MaxOff , offcodeLog = OffFSEv05Log ;
3684
+ U32 offcodeMaxValue = MaxOff , offcodeLog ;
3673
3685
short matchlengthNCount [MaxML + 1 ];
3674
- unsigned matchlengthMaxValue = MaxML , matchlengthLog = MLFSEv05Log ;
3686
+ unsigned matchlengthMaxValue = MaxML , matchlengthLog ;
3675
3687
short litlengthNCount [MaxLL + 1 ];
3676
- unsigned litlengthMaxValue = MaxLL , litlengthLog = LLFSEv05Log ;
3688
+ unsigned litlengthMaxValue = MaxLL , litlengthLog ;
3677
3689
3678
3690
hSize = HUFv05_readDTableX4 (dctx -> hufTableX4 , dict , dictSize );
3679
3691
if (HUFv05_isError (hSize )) return ERROR (dictionary_corrupted );
@@ -3682,19 +3694,22 @@ static size_t ZSTDv05_loadEntropy(ZSTDv05_DCtx* dctx, const void* dict, size_t d
3682
3694
3683
3695
offcodeHeaderSize = FSEv05_readNCount (offcodeNCount , & offcodeMaxValue , & offcodeLog , dict , dictSize );
3684
3696
if (FSEv05_isError (offcodeHeaderSize )) return ERROR (dictionary_corrupted );
3697
+ if (offcodeLog > OffFSEv05Log ) return ERROR (dictionary_corrupted );
3685
3698
errorCode = FSEv05_buildDTable (dctx -> OffTable , offcodeNCount , offcodeMaxValue , offcodeLog );
3686
3699
if (FSEv05_isError (errorCode )) return ERROR (dictionary_corrupted );
3687
3700
dict = (const char * )dict + offcodeHeaderSize ;
3688
3701
dictSize -= offcodeHeaderSize ;
3689
3702
3690
3703
matchlengthHeaderSize = FSEv05_readNCount (matchlengthNCount , & matchlengthMaxValue , & matchlengthLog , dict , dictSize );
3691
3704
if (FSEv05_isError (matchlengthHeaderSize )) return ERROR (dictionary_corrupted );
3705
+ if (matchlengthLog > MLFSEv05Log ) return ERROR (dictionary_corrupted );
3692
3706
errorCode = FSEv05_buildDTable (dctx -> MLTable , matchlengthNCount , matchlengthMaxValue , matchlengthLog );
3693
3707
if (FSEv05_isError (errorCode )) return ERROR (dictionary_corrupted );
3694
3708
dict = (const char * )dict + matchlengthHeaderSize ;
3695
3709
dictSize -= matchlengthHeaderSize ;
3696
3710
3697
3711
litlengthHeaderSize = FSEv05_readNCount (litlengthNCount , & litlengthMaxValue , & litlengthLog , dict , dictSize );
3712
+ if (litlengthLog > LLFSEv05Log ) return ERROR (dictionary_corrupted );
3698
3713
if (FSEv05_isError (litlengthHeaderSize )) return ERROR (dictionary_corrupted );
3699
3714
errorCode = FSEv05_buildDTable (dctx -> LLTable , litlengthNCount , litlengthMaxValue , litlengthLog );
3700
3715
if (FSEv05_isError (errorCode )) return ERROR (dictionary_corrupted );
0 commit comments