From: aimuz Date: Tue, 28 Nov 2023 13:04:37 +0000 (+0800) Subject: lib/decompress: check for reserved bit corruption in zstd X-Git-Tag: v1.5.6^2~52^2 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=468bb173782115e7bd2704f3a9e82341912eebd4;p=thirdparty%2Fzstd.git lib/decompress: check for reserved bit corruption in zstd The patch adds a validation to ensure that the last field, which is reserved, must be all-zeroes in ZSTD_decodeSeqHeaders. This prevents potential corruption from going undetected. Fixes an issue where corrupted input could lead to undefined behavior due to improper validation of reserved bits. Signed-off-by: aimuz --- diff --git a/lib/decompress/zstd_decompress_block.c b/lib/decompress/zstd_decompress_block.c index 19cbdc5c1..80c29db69 100644 --- a/lib/decompress/zstd_decompress_block.c +++ b/lib/decompress/zstd_decompress_block.c @@ -607,6 +607,7 @@ size_t ZSTD_decodeSeqHeaders(ZSTD_DCtx* dctx, int* nbSeqPtr, /* FSE table descriptors */ RETURN_ERROR_IF(ip+1 > iend, srcSize_wrong, ""); /* minimum possible size: 1 byte for symbol encoding types */ + RETURN_ERROR_IF(*ip & 3, corruption_detected, ""); /* The last field, Reserved, must be all-zeroes. */ { symbolEncodingType_e const LLtype = (symbolEncodingType_e)(*ip >> 6); symbolEncodingType_e const OFtype = (symbolEncodingType_e)((*ip >> 4) & 3); symbolEncodingType_e const MLtype = (symbolEncodingType_e)((*ip >> 2) & 3);