Commit 1a862175d52eb35efd7ecb368c1806b4ac1e7886 | zig

author	Dominic <4678790+dweiller@users.noreply.github.com> 2023-02-13 18:02:25+11:00
committer	Dominic <4678790+dweiller@users.noreply.github.com> 2023-02-20 09:09:06+11:00
log	1a862175d52eb35efd7ecb368c1806b4ac1e7886
tree	836eb01cfa9e640f282bb8e1e60b344577fe9985
parent	12aa478db08c5652d27228183bb898f65db7a2ae

2 files changed, 13 insertions(+), 4 deletions(-)

lib/std/compress/zstandard.zig+7-2

 @@ -177,9 +177,14 @@ pub fn ZstandardStream(
                 ) catch
                     return error.MalformedBlock;
+                if (self.frame_context.content_size) |size| {
+                    if (self.current_frame_decompressed_size > size) return error.MalformedFrame;
+                }
+                const size = self.buffer.len();
+                self.current_frame_decompressed_size += size;
                 if (self.frame_context.hasher_opt) |*hasher| {
-                    const size = self.buffer.len();
-                    self.current_frame_decompressed_size += size;
                     if (size > 0) {
                         const written_slice = self.buffer.sliceLast(size);
                         hasher.update(written_slice.first);

lib/std/compress/zstandard/decompress.zig+6-2

 @@ -497,6 +497,11 @@ pub fn decodeZstandardFrameBlocksArrayList(
             &consumed_count,
             frame_context.block_size_max,
         );
+        if (frame_context.content_size) |size| {
+            if (dest.items.len - initial_len > size) {
+                return error.BadContentSize;
+            }
+        }
         if (written_size > 0) {
             const written_slice = ring_buffer.sliceLast(written_size);
             try dest.appendSlice(written_slice.first);
 @@ -508,9 +513,8 @@ pub fn decodeZstandardFrameBlocksArrayList(
         }
         if (block_header.last_block) break;
     }
-    const added_len = dest.items.len - initial_len;
     if (frame_context.content_size) |size| {
-        if (added_len != size) {
+        if (dest.items.len - initial_len != size) {
             return error.BadContentSize;
         }
     }