{"action":"created","issue":{"url":"https://api.github.com/repos/Cyan4973/zstd/issues/11","labels_url":"https://api.github.com/repos/Cyan4973/zstd/issues/11/labels{/name}","comments_url":"https://api.github.com/repos/Cyan4973/zstd/issues/11/comments","events_url":"https://api.github.com/repos/Cyan4973/zstd/issues/11/events","html_url":"https://github.com/Cyan4973/zstd/issues/11","id":56048418,"number":11,"title":"zstd crashes on decoding invalid archives","user":{"login":"magv","id":1360822,"avatar_url":"https://avatars.githubusercontent.com/u/1360822?v=3","gravatar_id":"","url":"https://api.github.com/users/magv","html_url":"https://github.com/magv","followers_url":"https://api.github.com/users/magv/followers","following_url":"https://api.github.com/users/magv/following{/other_user}","gists_url":"https://api.github.com/users/magv/gists{/gist_id}","starred_url":"https://api.github.com/users/magv/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/magv/subscriptions","organizations_url":"https://api.github.com/users/magv/orgs","repos_url":"https://api.github.com/users/magv/repos","events_url":"https://api.github.com/users/magv/events{/privacy}","received_events_url":"https://api.github.com/users/magv/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":6,"created_at":"2015-01-30T15:43:04Z","updated_at":"2015-08-24T09:04:35Z","closed_at":"2015-08-23T23:20:06Z","body":"Hi. It seems that zstd will read illegal pointers and crash when presented with mangled archives. Here's one such example file (GitHub doesn't allow binary attachments, so I'm providing a hex dump):\r\n\r\n    0000000    fd  2f  b5  1c  00  00  1c  40  00  12  31  32  31  31  31  31\r\n    0000020    31  31  31  31  32  32  32  32  32  32  32  0a  10  98  00  ff\r\n    0000040    7f  00  84  c0  00  00\r\n\r\nHere's what gdb has to say about this problem:\r\n\r\n    (gdb) run -d <example.zst >example\r\n    Starting program: zstd -d <example.zst >example\r\n\r\n    Program received signal SIGSEGV, Segmentation fault.\r\n    0x0000000000410965 in ZSTD_decompressBlock (srcSize=28, src=0x801011000, maxDstSize=524288, dst=0x801032000, ctx=0x801006000) at lib/zstd.c:1533\r\n    (gdb) bt\r\n    #0  0x0000000000410965 in ZSTD_decompressBlock (srcSize=28, src=0x801011000, maxDstSize=524288, dst=0x801032000, ctx=0x801006000) at lib/zstd.c:1533\r\n    #1  ZSTD_decompressContinue (dctx=0x801006000, dst=0x801032000, maxDstSize=524288, src=0x801011000, srcSize=31) at lib/zstd.c:1680\r\n    #2  0x0000000000408681 in FIO_decompressFilename (output_filename=0x410f65 \"-\",input_filename=0x410f65 \"-\") at programs/fileio.c:363\r\n    #3  0x0000000000401a4d in main (argc=2, argv=0x7fffffffd9d0) at programs/zstdcli.c:314\r\n\r\nThis is with zstd as of commit 00f9507; the crash is located [over here](//github.com/Cyan4973/zstd/blob/00f9507d26ededd25f8fc023c9f58113a609a27b/lib/zstd.c#L1533). The problem is that `ZSTD_decompressBlock` does not validate how big `matchLength` can get; in this case it is equal to 8650883, while the `maxDstSize` is only 524288 bytes, which results in an attempt to copy past the end of the output buffer."},"comment":{"url":"https://api.github.com/repos/Cyan4973/zstd/issues/comments/134103188","html_url":"https://github.com/Cyan4973/zstd/issues/11#issuecomment-134103188","issue_url":"https://api.github.com/repos/Cyan4973/zstd/issues/11","id":134103188,"user":{"login":"magv","id":1360822,"avatar_url":"https://avatars.githubusercontent.com/u/1360822?v=3","gravatar_id":"","url":"https://api.github.com/users/magv","html_url":"https://github.com/magv","followers_url":"https://api.github.com/users/magv/followers","following_url":"https://api.github.com/users/magv/following{/other_user}","gists_url":"https://api.github.com/users/magv/gists{/gist_id}","starred_url":"https://api.github.com/users/magv/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/magv/subscriptions","organizations_url":"https://api.github.com/users/magv/orgs","repos_url":"https://api.github.com/users/magv/repos","events_url":"https://api.github.com/users/magv/events{/privacy}","received_events_url":"https://api.github.com/users/magv/received_events","type":"User","site_admin":false},"created_at":"2015-08-24T09:04:35Z","updated_at":"2015-08-24T09:04:35Z","body":"Not completely though. Here's another example file:\r\n\r\n    00000000  fd 2f b5 1e 00 00 31 40  00 20 31 32 32 32 32 32\r\n    00000010  32 31 33 31 32 33 31 31  31 32 32 32 32 32 33 31\r\n    00000020  32 32 31 31 32 32 32 32  32 0a 03 00 20 00 00 00\r\n    00000030  00 a1 00 10 00 08 42 10  c0 00 00\r\n\r\nIf you'll run `zstd -d` on it (as of commit 79d3b1e), it will segfault with this backtrace:\r\n\r\n    #0  0x000000000040c9ac in FSE_read64 (memPtr=0x70101103b) at fse.c:202\r\n    #1  0x000000000040c8f5 in FSE_readLE64 (memPtr=0x70101103b) at fse.c:277\r\n    #2  0x000000000040474b in FSE_readLEST (memPtr=0x70101103b) at fse.c:311\r\n    #3  0x0000000000404a1e in FSE_reloadDStream (bitD=0x7fffffffe470) at fse.c:1594\r\n    #4  0x0000000000404a7c in FSE_initDState (DStatePtr=0x7fffffffe490, bitD=0x7fffffffe470, dt=0x801006000) at fse.c:1604\r\n    #5  0x000000000040a5d9 in ZSTD_decompressSequences (ctx=0x801006000, dst=0x801032000, maxDstSize=524288, seqStart=0x801011023, seqSize=14, litStart=0x801011003 \"1222222131231112222231221122222\\n\\003\", litSize=32) at ../lib/zstd.c:1543\r\n    #6  0x000000000040a387 in ZSTD_decompressBlock (ctx=0x801006000, dst=0x801032000, maxDstSize=524288, src=0x801011000, srcSize=14) at ../lib/zstd.c:1591\r\n    #7  0x000000000040a1df in ZSTD_decompressContinue (dctx=0x801006000, dst=0x801032000, maxDstSize=524288, src=0x801011000, srcSize=49) at ../lib/zstd.c:1734\r\n    #8  0x00000000004167d5 in FIO_decompressFilename (output_filename=0x4181d6 \"-\", input_filename=0x7fffffffec50 \"--file-path-here--\") at fileio.c:362\r\n    #9  0x00000000004174ee in main (argc=3, argv=0x7fffffffe998) at zstdcli.c:334\r\n\r\nBTW, I'm using [this fuzzer](http://lcamtuf.coredump.cx/afl/) to find these crashes; I fully recommend you to use it too.\r\n"}}