Decoder doesn't check output size before allocating

[datadog]

Decoder doesn't check output size before allocating

[klauspost]

@kevinconaway The input is from a fuzz test. The value is likely from FrameContentSize which is a header value indicating the expected frame size.

The problem is that you can just set this value to whatever and crash the decoder. You need some sanity validation of this value.

[klauspost]

I just confirmed this to still be the case with the current 1.x.

This makes it extremely trivial to craft a DOS package, where you can crash any application feeding a very small zstd payload.

[kevinconaway]

Thanks for reporting this. Would you help me understand the behavior of ZSTD_getDecompressedSize here?

For the file that you posted, is the value that it is returning (52983525027888) a valid size? How was the file generated? The genesis of the file of course isn't relevant but I'm not really familiar with the internals of the algorithm so I'd like to understand the context here a bit more

Thanks.