Comments (3)
@kevinconaway The input is from a fuzz test. The value is likely from FrameContentSize
which is a header value indicating the expected frame size.
The problem is that you can just set this value to whatever and crash the decoder. You need some sanity validation of this value.
from zstd.
I just confirmed this to still be the case with the current 1.x
.
This makes it extremely trivial to craft a DOS package, where you can crash any application feeding a very small zstd payload.
from zstd.
Thanks for reporting this. Would you help me understand the behavior of ZSTD_getDecompressedSize
here?
For the file that you posted, is the value that it is returning (52983525027888
) a valid size? How was the file generated? The genesis of the file of course isn't relevant but I'm not really familiar with the internals of the algorithm so I'd like to understand the context here a bit more
Thanks.
from zstd.
Related Issues (20)
- ctx creation and customition HOT 3
- Mac M1 help HOT 1
- Decompress does not detect missing checksum
- Unable to decompress valid zstd content HOT 1
- Undefined behavior triggered in C code HOT 2
- Clarify zstd.NewWriterLevel usage for `n` separate units
- Not Support Apple M1 HOT 2
- Setting decompression WindowSize? HOT 1
- Update to Zstandard v1.5.5 HOT 1
- Unable to read valid zst file in version 1.5.2
- Decompress return UnexpectedEOF if Skippable frames written HOT 1
- Unable to use streaming Reader with bufio.NewScanner HOT 2
- failed to decompress: Unknown frame descriptor If padding is attached after compression HOT 7
- Building build/bin/configtxgen ERROR HOT 1
- Support zstd dictionary API for non-streaming use HOT 4
- If I have two types data --compressed and uncompressed, when I call the DeCompress function, would it report an error? HOT 1
- Add Go module file HOT 2
- TestStreamCompressionDecompressionParallel frequently fails on machines with many cpus HOT 8
- [zstd_stream] Reader.Read can block even if a zstd block is available HOT 1
- Can not work with archive/tar HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from zstd.