From 8b9cdd25979d3f7335f1d29bb8ebc10dffd33fe3 Mon Sep 17 00:00:00 2001
From: Yann Collet <cyan@fb.com>
Date: Sun, 26 Jul 2020 22:40:21 -0700
Subject: [PATCH] fixed overlapping count & workspace special case

---
 lib/compress/hist.c | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/lib/compress/hist.c b/lib/compress/hist.c
index 1d6364b78..c8b2ebb75 100644
--- a/lib/compress/hist.c
+++ b/lib/compress/hist.c
@@ -71,20 +71,21 @@ static size_t HIST_count_parallel_wksp(
 {
     const BYTE* ip = (const BYTE*)source;
     const BYTE* const iend = ip+sourceSize;
+    size_t const countSize = (*maxSymbolValuePtr + 1) * sizeof(*count);
     unsigned max=0;
     U32* const Counting1 = workSpace;
     U32* const Counting2 = Counting1 + 256;
     U32* const Counting3 = Counting2 + 256;
     U32* const Counting4 = Counting3 + 256;
 
-    memset(workSpace, 0, 4*256*sizeof(unsigned));
-
     /* safety checks */
+    assert(*maxSymbolValuePtr <= 255);
     if (!sourceSize) {
-        memset(count, 0, (*maxSymbolValuePtr + 1) * 4);
+        memset(count, 0, countSize);
         *maxSymbolValuePtr = 0;
         return 0;
     }
+    memset(workSpace, 0, 4*256*sizeof(unsigned));
 
     /* by stripes of 16 bytes */
     {   U32 cached = MEM_read32(ip); ip += 4;
@@ -126,7 +127,7 @@ static size_t HIST_count_parallel_wksp(
         while (!Counting1[maxSymbolValue]) maxSymbolValue--;
         if (check && maxSymbolValue > *maxSymbolValuePtr) return ERROR(maxSymbolValue_tooSmall);
         *maxSymbolValuePtr = maxSymbolValue;
-        memcpy(count, Counting1, (maxSymbolValue+1) * 4);
+        memmove(count, Counting1, countSize);   /* in case count & Counting1 are overlapping */
     }
     return (size_t)max;
 }
-- 
2.47.2