]> git.ipfire.org Git - thirdparty/zstd.git/commitdiff
Fix bounds check in ZSTD_storeSeq()
authorNick Terrell <nickrterrell@gmail.com>
Fri, 20 Sep 2019 15:25:12 +0000 (08:25 -0700)
committerNick Terrell <nickrterrell@gmail.com>
Fri, 20 Sep 2019 15:25:12 +0000 (08:25 -0700)
lib/compress/zstd_compress_internal.h

index bc654bcc97997709164a326f4b7e457a71639d6c..83221757e52f22c6b2c3135609c3700d7740f0f9 100644 (file)
@@ -361,8 +361,8 @@ MEM_STATIC void ZSTD_storeSeq(seqStore_t* seqStorePtr, size_t litLength, const B
     assert(seqStorePtr->maxNbLit <= 128 KB);
     assert(seqStorePtr->lit + litLength <= seqStorePtr->litStart + seqStorePtr->maxNbLit);
     /* We are guaranteed at least 8 bytes of literals space because of HASH_READ_SIZE. */
-    assert(litLimit - literals >= HASH_READ_SIZE);
-    if (litLimit - literals >= WILDCOPY_OVERLENGTH)
+    assert(literals + litLength + HASH_READ_SIZE <= litLimit);
+    if (literals + litLength + WILDCOPY_OVERLENGTH <= litLimit)
            ZSTD_wildcopy(seqStorePtr->lit, literals, (ptrdiff_t)litLength, ZSTD_no_overlap);
     else
            ZSTD_wildcopy8(seqStorePtr->lit, literals, (ptrdiff_t)litLength);