Fixed decoding error #11 (reported by @magv)

diff --git a/lib/zstd.c b/lib/zstd.c
index bcc16c877b3460d8cc996959db6e15b1d365d42e..b93cca4ee6e523416e10aab94a03e68598f8641c 100644 (file)
--- a/lib/zstd.c
+++ b/lib/zstd.c
@@ -1269,7 +1269,7 @@ size_t ZSTD_decodeSeqHeaders(int* nbSeq, const BYTE** dumpsPtr,
     ip += dumpsLength;
 
        /* check */
-       if (ip > iend-1) return (size_t)-ZSTD_ERROR_SrcSize;
+       if (ip > iend-3) return (size_t)-ZSTD_ERROR_SrcSize; /* min : all 3 are "raw", hence no header, but at least xxLog bits per type */
 
     /* sequences */
     {
@@ -1300,6 +1300,7 @@ size_t ZSTD_decodeSeqHeaders(int* nbSeq, const BYTE** dumpsPtr,
         U32 max;
         case bt_rle :
             Offlog = 0;
+            if (ip > iend-2) return (size_t)-ZSTD_ERROR_SrcSize; /* min : "raw", hence no header, but at least xxLog bits */
             FSE_buildDTable_rle(DTableOffb, *ip++); break;
         case bt_raw :
             Offlog = Offbits;
@@ -1318,6 +1319,7 @@ size_t ZSTD_decodeSeqHeaders(int* nbSeq, const BYTE** dumpsPtr,
         U32 max;
         case bt_rle :
             MLlog = 0;
+            if (ip > iend-2) return (size_t)-ZSTD_ERROR_SrcSize; /* min : "raw", hence no header, but at least xxLog bits */
             FSE_buildDTable_rle(DTableML, *ip++); break;
         case bt_raw :
             MLlog = MLbits;

diff --git a/programs/fileio.c b/programs/fileio.c
index ee23dc01cf9182bf989f8ef57ee3cc00ac7f8d3a..c137c78ba09699df3673eab94145988a165d807c 100644 (file)
--- a/programs/fileio.c
+++ b/programs/fileio.c
@@ -360,12 +360,13 @@ unsigned long long FIO_decompressFilename(const char* output_filename, const cha
 
         /* Decode block */
         decodedSize = ZSTD_decompressContinue(dctx, op, oend-op, inBuff, readSize);
+        if (ZSTD_isError(decodedSize)) EXM_THROW(35, "Decoding error : input corrupted");
 
         if (decodedSize)   /* not a header */
         {
             /* Write block */
             sizeCheck = fwrite(op, 1, decodedSize, foutput);
-            if (sizeCheck != decodedSize) EXM_THROW(35, "Write error : unable to write data block to destination file");
+            if (sizeCheck != decodedSize) EXM_THROW(36, "Write error : unable to write data block to destination file");
             filesize += decodedSize;
             op += decodedSize;
             if (op==oend) op = outBuff;