Fixed a few issues found by AFL (American Fuzzy Lop)

diff --git a/lib/zstd.c b/lib/zstd.c
index b93cca4ee6e523416e10aab94a03e68598f8641c..462b335a06e92a2ae1b1cc29dd2747143fdc781a 100644 (file)
--- a/lib/zstd.c
+++ b/lib/zstd.c
@@ -1172,7 +1172,12 @@ static size_t ZSTD_decompressLiterals(void* ctx,
     BYTE* const oend = op + maxDstSize;
     const BYTE* ip = (const BYTE*)src;
     size_t errorCode;
-    size_t litSize = ip[1] + (ip[0]<<8);
+    size_t litSize;
+
+    /* check : minimum 2, for litSize, +1, for content */
+    if (srcSize <= 3) return (size_t)-ZSTD_ERROR_corruption;
+
+    litSize = ip[1] + (ip[0]<<8);
     litSize += ((ip[-3] >> 3) & 7) << 16;   // mmmmh....
     op = oend - litSize;
 

diff --git a/programs/datagencli.c b/programs/datagencli.c
index 2665c54bd1bd6a1ac7e9a18a18a797ed9fc57d52..ce581bafc992d635a503b06b11a935a7b5a87087 100644 (file)
--- a/programs/datagencli.c
+++ b/programs/datagencli.c
@@ -81,7 +81,7 @@ static int usage(char* programName)
 {
     DISPLAY( "Compressible data generator\n");
     DISPLAY( "Usage :\n");
-    DISPLAY( "      %s [size] [args]\n", programName);
+    DISPLAY( "      %s [args]\n", programName);
     DISPLAY( "\n");
     DISPLAY( "Arguments :\n");
     DISPLAY( " -g#    : generate # data (default:%i)\n", SIZE_DEFAULT);

diff --git a/programs/fileio.c b/programs/fileio.c
index c137c78ba09699df3673eab94145988a165d807c..d1c4a7c7f06548b0bb1019ba8b94ff6a5b228230 100644 (file)
--- a/programs/fileio.c
+++ b/programs/fileio.c
@@ -354,19 +354,21 @@ unsigned long long FIO_decompressFilename(const char* output_filename, const cha
         size_t readSize, decodedSize;
 
         /* Fill input buffer */
+        if (toRead > inBuffSize)
+            EXM_THROW(34, "too large block");
         readSize = fread(inBuff, 1, toRead, finput);
         if (readSize != toRead)
-            EXM_THROW(34, "Read error");
+            EXM_THROW(35, "Read error");
 
         /* Decode block */
         decodedSize = ZSTD_decompressContinue(dctx, op, oend-op, inBuff, readSize);
-        if (ZSTD_isError(decodedSize)) EXM_THROW(35, "Decoding error : input corrupted");
+        if (ZSTD_isError(decodedSize)) EXM_THROW(36, "Decoding error : input corrupted");
 
         if (decodedSize)   /* not a header */
         {
             /* Write block */
             sizeCheck = fwrite(op, 1, decodedSize, foutput);
-            if (sizeCheck != decodedSize) EXM_THROW(36, "Write error : unable to write data block to destination file");
+            if (sizeCheck != decodedSize) EXM_THROW(37, "Write error : unable to write data block to destination file");
             filesize += decodedSize;
             op += decodedSize;
             if (op==oend) op = outBuff;