From 468bb173782115e7bd2704f3a9e82341912eebd4 Mon Sep 17 00:00:00 2001 From: aimuz Date: Tue, 28 Nov 2023 21:04:37 +0800 Subject: [PATCH] lib/decompress: check for reserved bit corruption in zstd The patch adds a validation to ensure that the last field, which is reserved, must be all-zeroes in ZSTD_decodeSeqHeaders. This prevents potential corruption from going undetected. Fixes an issue where corrupted input could lead to undefined behavior due to improper validation of reserved bits. Signed-off-by: aimuz --- lib/decompress/zstd_decompress_block.c | 1 + 1 file changed, 1 insertion(+) diff --git a/lib/decompress/zstd_decompress_block.c b/lib/decompress/zstd_decompress_block.c index 19cbdc5c1..80c29db69 100644 --- a/lib/decompress/zstd_decompress_block.c +++ b/lib/decompress/zstd_decompress_block.c @@ -607,6 +607,7 @@ size_t ZSTD_decodeSeqHeaders(ZSTD_DCtx* dctx, int* nbSeqPtr, /* FSE table descriptors */ RETURN_ERROR_IF(ip+1 > iend, srcSize_wrong, ""); /* minimum possible size: 1 byte for symbol encoding types */ + RETURN_ERROR_IF(*ip & 3, corruption_detected, ""); /* The last field, Reserved, must be all-zeroes. */ { symbolEncodingType_e const LLtype = (symbolEncodingType_e)(*ip >> 6); symbolEncodingType_e const OFtype = (symbolEncodingType_e)((*ip >> 4) & 3); symbolEncodingType_e const MLtype = (symbolEncodingType_e)((*ip >> 2) & 3); -- 2.47.2