denuvo-ref/zstd
1
0
Fork 0
mirror of https://github.com/facebook/zstd synced 2026-08-22 22:32:07 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

fix off-by-one bounds check in ZSTD_seekTable_getFrameDecompressedSize

Browse source
This commit is contained in:
Saleem Malik 2026-07-22 12:53:40 +05:30
parent 5c7b7bad26
commit f85f528c78
2 changed files with 5 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

4
contrib/seekable_format/tests/seekable_tests.c
View file

@ -121,6 +121,10 @@ int main(int argc, const char** argv)
size_t const origSize = ZSTD_seekTable_getFrameDecompressedSize(zst, 0);
assert(origSize == inSize);
/* out-of-range frame index must be rejected, not read past the table */
assert(ZSTD_isError(ZSTD_seekTable_getFrameCompressedSize(zst, nbFrames)));
assert(ZSTD_isError(ZSTD_seekTable_getFrameDecompressedSize(zst, nbFrames)));
unsigned const fo1idx = ZSTD_seekTable_offsetToFrameIndex(zst, 1);
assert(fo1idx == 0);

2
contrib/seekable_format/zstdseek_decompress.c
View file

@ -366,7 +366,7 @@ size_t ZSTD_seekable_getFrameDecompressedSize(const ZSTD_seekable* zs, unsigned
size_t ZSTD_seekTable_getFrameDecompressedSize(const ZSTD_seekTable* st, unsigned frameIndex)
{
if (frameIndex > st->tableLen) return ERROR(frameIndex_tooLarge);
if (frameIndex >= st->tableLen) return ERROR(frameIndex_tooLarge);
return st->entries[frameIndex + 1].dOffset -
st->entries[frameIndex].dOffset;
}