39 lines
1.5 KiB
Diff
39 lines
1.5 KiB
Diff
|
From 2c67902d594f7ae37b68cef1692b823b4b497e92 Mon Sep 17 00:00:00 2001
|
||
|
|
From: "W. Felix Handte" <w@felixhandte.com>
|
||
|
|
Date: Thu, 18 Jul 2019 12:41:12 -0400
|
||
|
|
Subject: [PATCH 3/3] Fix Data Corruption Bug when Streaming with an Attached
|
||
|
|
Dict in HC Mode
|
||
|
|
|
||
|
|
This diff fixes an issue in which we failed to clear the `dictCtx` in HC
|
||
|
|
compression. The `dictCtx` is not supposed to be used when an `extDict` is
|
||
|
|
present: matches found in the `dictCtx` do not account for the presence of an
|
||
|
|
`extDict` segment, and their offsets are therefore miscalculated when one is
|
||
|
|
present. This can lead to data corruption.
|
||
|
|
|
||
|
|
This diff clears the `dictCtx` whenever setting an `extDict`.
|
||
|
|
|
||
|
|
This issue was uncovered by @terrelln's fuzzing work.
|
||
|
|
---
|
||
|
|
lib/lz4hc.c | 5 +++++
|
||
|
|
1 file changed, 5 insertions(+)
|
||
|
|
|
||
|
|
diff --git a/lib/lz4hc.c b/lib/lz4hc.c
|
||
|
|
index b62e085..98813a6 100644
|
||
|
|
--- a/lib/lz4hc.c
|
||
|
|
+++ b/lib/lz4hc.c
|
||
|
|
@@ -940,6 +940,11 @@ static void LZ4HC_setExternalDict(LZ4HC_CCtx_internal* ctxPtr, const BYTE* newBl
|
||
|
|
if (ctxPtr->end >= ctxPtr->base + ctxPtr->dictLimit + 4)
|
||
|
|
LZ4HC_Insert (ctxPtr, ctxPtr->end-3); /* Referencing remaining dictionary content */
|
||
|
|
|
||
|
|
+ /* cannot reference an extDict and a dictCtx at the same time */
|
||
|
|
+ if (ctxPtr->dictCtx != NULL) {
|
||
|
|
+ ctxPtr->dictCtx = NULL;
|
||
|
|
+ }
|
||
|
|
+
|
||
|
|
/* Only one memory segment for extDict, so any previous extDict is lost at this stage */
|
||
|
|
ctxPtr->lowLimit = ctxPtr->dictLimit;
|
||
|
|
ctxPtr->dictLimit = (U32)(ctxPtr->end - ctxPtr->base);
|
||
|
|
--
|
||
|
|
1.8.3.1
|
||
|
|
|