{"action":"closed","issue":{"url":"https://api.github.com/repos/Cyan4973/zstd/issues/22","labels_url":"https://api.github.com/repos/Cyan4973/zstd/issues/22/labels{/name}","comments_url":"https://api.github.com/repos/Cyan4973/zstd/issues/22/comments","events_url":"https://api.github.com/repos/Cyan4973/zstd/issues/22/events","html_url":"https://github.com/Cyan4973/zstd/issues/22","id":58361528,"number":22,"title":"Buffer bounds","user":{"login":"luben","id":391130,"avatar_url":"https://avatars.githubusercontent.com/u/391130?v=3","gravatar_id":"","url":"https://api.github.com/users/luben","html_url":"https://github.com/luben","followers_url":"https://api.github.com/users/luben/followers","following_url":"https://api.github.com/users/luben/following{/other_user}","gists_url":"https://api.github.com/users/luben/gists{/gist_id}","starred_url":"https://api.github.com/users/luben/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/luben/subscriptions","organizations_url":"https://api.github.com/users/luben/orgs","repos_url":"https://api.github.com/users/luben/repos","events_url":"https://api.github.com/users/luben/events{/privacy}","received_events_url":"https://api.github.com/users/luben/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":4,"created_at":"2015-02-20T14:41:59Z","updated_at":"2015-07-08T01:48:02Z","closed_at":"2015-07-08T01:48:02Z","body":"I understand that the project is in experimental stage and I am not expecting to be bugs-free. So here is one bug.\r\n\r\nSometimes the destination buffer bounds are not checked properly (when compressing/decompressing) and overflows happens that could lead to a lot of nasty thing. Here is a code that demonstrates it:\r\n\r\n```C\r\n#include <stdio.h>\r\n#include <stdlib.h>\r\n#include <zstd.h>\r\n\r\nint main(int argc, char **argv ) {\r\n    char *raw = (char *)malloc(1000);\r\n    char compressed[20];\r\n    char decompressed[900];\r\n    size_t i, ccode, dcode;\r\n\r\n    // fill it with ones\r\n    for (i=0; i<1000; i++) raw[i] = 1;\r\n\r\n    ccode = ZSTD_compress(compressed, 20, raw, 1000);\r\n    printf(\"Compression code %i\\n\", ccode);\r\n    dcode = ZSTD_decompress(decompressed, 900, compressed, ccode);\r\n    printf(\"Decompression code %i\\n\", dcode);\r\n    return 0;\r\n}\r\n```\r\n\r\nRegards"}}