]> git.ipfire.org Git - thirdparty/zstd.git/commitdiff
[fuzz] msan uninitialized unsigned value (#1908)
authorBimba Shrestha <bimbashrestha@fb.com>
Wed, 4 Dec 2019 18:02:17 +0000 (10:02 -0800)
committerNick Terrell <terrelln@fb.com>
Wed, 4 Dec 2019 18:02:17 +0000 (10:02 -0800)
Fixes new fuzz issue

Credit to OSS-Fuzz

* Initializing unsigned value

* Initialilzing to 1 instead of 0 because its more conservative

* Unconditionoally setting to check first and then checking zero

* Moving bool to before block for c90

* Move check set before block

lib/compress/zstd_compress.c

index 682c9c047d03e2495f4ac7be8059fa0643a4066c..16476f6fa9ed014d35ff254a4ca48885ec310667 100644 (file)
@@ -2858,9 +2858,10 @@ size_t ZSTD_loadCEntropy(ZSTD_compressedBlockState_t* bs, void* workspace,
     const BYTE* dictPtr = (const BYTE*)dict;    /* skip magic num and dict ID */
     const BYTE* const dictEnd = dictPtr + dictSize;
     dictPtr += 8;
+    bs->entropy.huf.repeatMode = HUF_repeat_check;
 
     {   unsigned maxSymbolValue = 255;
-        unsigned hasZeroWeights;
+        unsigned hasZeroWeights = 1;
         size_t const hufHeaderSize = HUF_readCTable((HUF_CElt*)bs->entropy.huf.CTable, &maxSymbolValue, dictPtr,
             dictEnd-dictPtr, &hasZeroWeights);
 
@@ -2868,7 +2869,6 @@ size_t ZSTD_loadCEntropy(ZSTD_compressedBlockState_t* bs, void* workspace,
          * weights. Otherwise, we set it to check */
         if (!hasZeroWeights)
             bs->entropy.huf.repeatMode = HUF_repeat_valid;
-        else bs->entropy.huf.repeatMode = HUF_repeat_check;
 
         RETURN_ERROR_IF(HUF_isError(hufHeaderSize), dictionary_corrupted);
         RETURN_ERROR_IF(maxSymbolValue < 255, dictionary_corrupted);