From: Yann Collet <yann.collet.73@gmail.com>
Date: Sat, 28 Nov 2015 17:19:44 +0000 (+0100)
Subject: fixed decoder error (rollbuffer mode)
X-Git-Tag: zstd-0.4.0^2~4
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=bf7aa3c14e5e238688400d65507c0ee1ae0c8c1c;p=thirdparty%2Fzstd.git

fixed decoder error (rollbuffer mode)
---

diff --git a/lib/error.h b/lib/error.h
index cfdaf5003..3c39c39ca 100644
--- a/lib/error.h
+++ b/lib/error.h
@@ -68,7 +68,7 @@ extern "C" {
 
 #define ERROR_LIST(ITEM) \
         ITEM(PREFIX(No_Error)) ITEM(PREFIX(GENERIC)) \
-        ITEM(PREFIX(prefix_unknown)) ITEM(PREFIX(frameParameter_unsupportedBy32bitsImplementation)) \
+        ITEM(PREFIX(prefix_unknown)) ITEM(PREFIX(frameParameter_unsupported)) ITEM(PREFIX(frameParameter_unsupportedBy32bitsImplementation)) \
         ITEM(PREFIX(init_missing)) ITEM(PREFIX(memory_allocation)) \
         ITEM(PREFIX(dstSize_tooSmall)) ITEM(PREFIX(srcSize_wrong)) \
         ITEM(PREFIX(corruption_detected)) \
diff --git a/lib/zstd_decompress.c b/lib/zstd_decompress.c
index 66de4bc99..e8190bc47 100644
--- a/lib/zstd_decompress.c
+++ b/lib/zstd_decompress.c
@@ -195,6 +195,7 @@ size_t ZSTD_getFrameParams(ZSTD_parameters* params, const void* src, size_t srcS
     if (magicNumber != ZSTD_MAGICNUMBER) return ERROR(prefix_unknown);
     memset(params, 0, sizeof(*params));
     params->windowLog = (((const BYTE*)src)[4] & 15) + ZSTD_WINDOWLOG_ABSOLUTEMIN;
+    if ((((const BYTE*)src)[4] >> 4) != 0) return ERROR(frameParameter_unsupported);   /* reserved bits */
     return 0;
 }
 
@@ -785,8 +786,8 @@ size_t ZSTD_decompressContinue(ZSTD_DCtx* ctx, void* dst, size_t maxDstSize, con
     if (srcSize != ctx->expected) return ERROR(srcSize_wrong);
     if (dst != ctx->previousDstEnd)   /* not contiguous */
     {
-        if (((char*)dst + maxDstSize > (char*)ctx->base) && (dst < ctx->previousDstEnd))   /* rolling buffer : new segment into dictionary */
-            ctx->base = (char*)dst + maxDstSize;   /* temporary affectation, for vBase calculation */
+        if ((dst > ctx->base) && (dst < ctx->previousDstEnd))   /* rolling buffer : new segment into dictionary */
+            ctx->base = (char*)dst;   /* temporary affectation, for vBase calculation */
         ctx->dictEnd = ctx->previousDstEnd;
         ctx->vBase = (char*)dst - ((char*)(ctx->previousDstEnd) - (char*)(ctx->base));
         ctx->base = dst;