12 results · Feed
-
Unscored —
Use-after-free when changing a multithreaded context with an unfinished frame
When a multithreaded frame (`zstdmt` feature, `CParameter::NbWorkers`) is left unfinished, its jobs may still be running on the worker threads: the C library only waits for them when the next frame starts, or when the context is freed. A session reset makes t…
-
Unscored —
Out-of-bounds read with an out-of-range `InBuffer::pos`
`InBuffer`'s fields are public, so safe code can set `pos` past the end of `src`. The position was passed to the C library unchecked, and `ZSTD_seekable_compressStream`, unlike the other streaming functions, does not validate it: it read past the end of the i…
-
Unscored —
Double free in `DCtx::try_clone`
`DCtx::try_clone` (`experimental` feature, deprecated) is a plain copy of the C context. A context owning a dictionary (from `load_dictionary`, `ref_prefix` or `init_using_dict`) or a dictionary table (`ref_ddict` with `RefMultipleDDicts`) ended up with both …
-
Unscored —
Uninitialized memory exposed when streaming decompression of a legacy frame fails
When decompression fails inside a legacy (zstd v0.4 to v0.7) frame, the bundled zstd library reports the output buffer as fully written although nothing was written. `DCtx::decompress_stream` committed that position even on error, and for a `Vec<u8>` destinat…
-
Unscored —
Heap buffer overflow in `CCtx::try_clone` on a multithreaded context
`CCtx::try_clone` (`experimental` feature, deprecated) copies tables sized from the context's applied parameters. Starting a multithreaded frame (`zstdmt` feature) replaces those parameters with the workers' without resizing the context's own tables, so after…
-
Unscored —
Out-of-bounds read in `train_from_buffer` when sample sizes overflow
`ZDICT_trainFromBuffer` is never told the length of the samples buffer, so `train_from_buffer` checked that the sample sizes add up to it. With overflow checks off, as in release builds, that sum wrapped around: sizes totalling 2^64 plus the buffer length pas…
-
Unscored —
Use-after-free of a dictionary after a one-shot call on a context with an open stream
The one-shot `DCtx` and `CCtx` methods assumed the C library resets the context, but it leaves an open stream as it is. When a stream was left unfinished on a context, a one-shot call such as `decompress_using_dict` could leave the context pointing at the dic…
-
Unscored —
Use-after-free through `init_using_cdict` and `init_using_ddict`
`CCtx::init_using_cdict` and `DCtx::init_using_ddict` (`experimental` feature, deprecated) took the dictionary as `&CDict<'b>` and `&DDict<'b>` with only `'b: 'a`, so the dictionary itself could be dropped while the context still pointed at it. The same mista…
-
Unscored —
`Seekable::decompress` sets a `Vec` length beyond its capacity for offsets past the end
`ZSTD_seekable_decompress` shortens the requested length to the end of the data without checking that the offset is before it. For an offset past the end, it returns a wrapped-around length without writing anything, and `Seekable::decompress` passed that leng…
-
Unscored —
`OutBuffer::around_pos` exposes uninitialized memory
`OutBuffer::around_pos` accepted a position past the initialized length of a `Vec<u8>`. The next streaming call then marked everything before the position as initialized, so safe code could read stale heap memory between the vector's previous length and that …
-
Unscored —
`Seekable` reads a NULL or out-of-bounds seek table
`Seekable` did not record whether it was initialized. On a fresh `Seekable`, or one whose `init_buff()` failed, `decompress`, `offset_to_frame_index` and `frame_decompressed_size` made the C library read a NULL seek table. After a failed re-initialization, `d…
-
Unscored —
Use-after-free with `CParameter::StableInBuffer`
With `CParameter::StableInBuffer(true)` (`experimental` feature), the C library keeps a pointer to the input of one streaming call and reads from it in later calls, including `flush_stream` and `end_stream`, which take no input. An `InBuffer` only borrows its…