zstdtest has some inline data where some testcases lack the
uncompressed length field. Thus it computes that but still
ends up allocating memory for the uncompressed buffer based on
that (zero) length. Oops. Causes memory corruption if the
allocator returns non-NULL.
libbacktrace/
* zstdtest.c (test_samples): Properly compute the allocation
size for the uncompressed data.
unsigned char *uncompressed;
size_t uncompressed_len;
- uncompressed = (unsigned char *) malloc (tests[i].uncompressed_len);
+ uncompressed_len = tests[i].uncompressed_len;
+ if (uncompressed_len == 0)
+ uncompressed_len = strlen (tests[i].uncompressed);
+
+ uncompressed = (unsigned char *) malloc (uncompressed_len);
if (uncompressed == NULL)
{
perror ("malloc");
continue;
}
- uncompressed_len = tests[i].uncompressed_len;
- if (uncompressed_len == 0)
- uncompressed_len = strlen (tests[i].uncompressed);
-
if (!backtrace_uncompress_zstd (state,
((const unsigned char *)
tests[i].compressed),