authorgravatar for 4678790+dweiller@users.noreply.github.comDominic <4678790+dweiller@users.noreply.github.com> 2023-01-24 14:30:32+11:00
committergravatar for 4678790+dweiller@users.noreply.github.comDominic <4678790+dweiller@users.noreply.github.com> 2023-02-20 09:09:06+11:00
log774e2f5a5c918cccfc455bcb73d90be43ec9a9eb
treea3dd2b546883fae1191860c61e17065b863d472a
parent31d1cae8c68fbc765fd4394863b071788dbc9746

std.compress.zstandard: add input length safety checks

1 files changed, 37 insertions(+), 19 deletions(-)

lib/std/compress/zstandard/decompress.zig+37-19
......@@ -680,7 +680,8 @@ pub fn decodeFrameBlocks(dest: []u8, src: []const u8, consumed_count: *usize, ha
680680 return written_count;
681681}
682682
683fn decodeRawBlock(dest: []u8, src: []const u8, block_size: u21, consumed_count: *usize) usize {
683fn decodeRawBlock(dest: []u8, src: []const u8, block_size: u21, consumed_count: *usize) !usize {
684 if (src.len < block_size) return error.MalformedBlockSize;
684685 log.debug("writing raw block - size {d}", .{block_size});
685686 const data = src[0..block_size];
686687 std.mem.copy(u8, dest, data);
......@@ -688,7 +689,8 @@ fn decodeRawBlock(dest: []u8, src: []const u8, block_size: u21, consumed_count:
688689 return block_size;
689690}
690691
691fn decodeRawBlockRingBuffer(dest: *RingBuffer, src: []const u8, block_size: u21, consumed_count: *usize) usize {
692fn decodeRawBlockRingBuffer(dest: *RingBuffer, src: []const u8, block_size: u21, consumed_count: *usize) !usize {
693 if (src.len < block_size) return error.MalformedBlockSize;
692694 log.debug("writing raw block - size {d}", .{block_size});
693695 const data = src[0..block_size];
694696 dest.writeSliceAssumeCapacity(data);
......@@ -696,7 +698,8 @@ fn decodeRawBlockRingBuffer(dest: *RingBuffer, src: []const u8, block_size: u21,
696698 return block_size;
697699}
698700
699fn decodeRleBlock(dest: []u8, src: []const u8, block_size: u21, consumed_count: *usize) usize {
701fn decodeRleBlock(dest: []u8, src: []const u8, block_size: u21, consumed_count: *usize) !usize {
702 if (src.len < 1) return error.MalformedRleBlock;
700703 log.debug("writing rle block - '{x}'x{d}", .{ src[0], block_size });
701704 var write_pos: usize = 0;
702705 while (write_pos < block_size) : (write_pos += 1) {
......@@ -706,7 +709,8 @@ fn decodeRleBlock(dest: []u8, src: []const u8, block_size: u21, consumed_count:
706709 return block_size;
707710}
708711
709fn decodeRleBlockRingBuffer(dest: *RingBuffer, src: []const u8, block_size: u21, consumed_count: *usize) usize {
712fn decodeRleBlockRingBuffer(dest: *RingBuffer, src: []const u8, block_size: u21, consumed_count: *usize) !usize {
713 if (src.len < 1) return error.MalformedRleBlock;
710714 log.debug("writing rle block - '{x}'x{d}", .{ src[0], block_size });
711715 var write_pos: usize = 0;
712716 while (write_pos < block_size) : (write_pos += 1) {
......@@ -727,11 +731,11 @@ pub fn decodeBlock(
727731 const block_size_max = @min(1 << 17, dest[written_count..].len); // 128KiB
728732 const block_size = block_header.block_size;
729733 if (block_size_max < block_size) return error.BlockSizeOverMaximum;
730 // TODO: we probably want to enable safety for release-fast and release-small (or insert custom checks)
731734 switch (block_header.block_type) {
732735 .raw => return decodeRawBlock(dest[written_count..], src, block_size, consumed_count),
733736 .rle => return decodeRleBlock(dest[written_count..], src, block_size, consumed_count),
734737 .compressed => {
738 if (src.len < block_size) return error.MalformedBlockSize;
735739 var bytes_read: usize = 0;
736740 const literals = try decodeLiteralsSection(src, &bytes_read);
737741 const sequences_header = try decodeSequencesHeader(src[bytes_read..], &bytes_read);
......@@ -796,11 +800,11 @@ pub fn decodeBlockRingBuffer(
796800) !usize {
797801 const block_size = block_header.block_size;
798802 if (block_size_max < block_size) return error.BlockSizeOverMaximum;
799 // TODO: we probably want to enable safety for release-fast and release-small (or insert custom checks)
800803 switch (block_header.block_type) {
801804 .raw => return decodeRawBlockRingBuffer(dest, src, block_size, consumed_count),
802805 .rle => return decodeRleBlockRingBuffer(dest, src, block_size, consumed_count),
803806 .compressed => {
807 if (src.len < block_size) return error.MalformedBlockSize;
804808 var bytes_read: usize = 0;
805809 const literals = try decodeLiteralsSection(src, &bytes_read);
806810 const sequences_header = try decodeSequencesHeader(src[bytes_read..], &bytes_read);
......@@ -957,11 +961,11 @@ pub fn decodeBlockHeader(src: *const [3]u8) frame.ZStandard.Block.Header {
957961}
958962
959963pub fn decodeLiteralsSection(src: []const u8, consumed_count: *usize) !LiteralsSection {
960 // TODO: we probably want to enable safety for release-fast and release-small (or insert custom checks)
961964 var bytes_read: usize = 0;
962 const header = decodeLiteralsHeader(src, &bytes_read);
965 const header = try decodeLiteralsHeader(src, &bytes_read);
963966 switch (header.block_type) {
964967 .raw => {
968 if (src.len < bytes_read + header.regenerated_size) return error.MalformedLiteralsSection;
965969 const stream = src[bytes_read .. bytes_read + header.regenerated_size];
966970 consumed_count.* += header.regenerated_size + bytes_read;
967971 return LiteralsSection{
......@@ -971,6 +975,7 @@ pub fn decodeLiteralsSection(src: []const u8, consumed_count: *usize) !LiteralsS
971975 };
972976 },
973977 .rle => {
978 if (src.len < bytes_read + 1) return error.MalformedLiteralsSection;
974979 const stream = src[bytes_read .. bytes_read + 1];
975980 consumed_count.* += 1 + bytes_read;
976981 return LiteralsSection{
......@@ -990,18 +995,19 @@ pub fn decodeLiteralsSection(src: []const u8, consumed_count: *usize) !LiteralsS
990995 log.debug("huffman tree size = {}, total streams size = {}", .{ huffman_tree_size, total_streams_size });
991996 if (huffman_tree) |tree| dumpHuffmanTree(tree);
992997
998 if (src.len < bytes_read + total_streams_size) return error.MalformedLiteralsSection;
999 const stream_data = src[bytes_read .. bytes_read + total_streams_size];
1000
9931001 if (header.size_format == 0) {
994 const stream = src[bytes_read .. bytes_read + total_streams_size];
995 bytes_read += total_streams_size;
996 consumed_count.* += bytes_read;
1002 consumed_count.* += total_streams_size + bytes_read;
9971003 return LiteralsSection{
9981004 .header = header,
9991005 .huffman_tree = huffman_tree,
1000 .streams = .{ .one = stream },
1006 .streams = .{ .one = stream_data },
10011007 };
10021008 }
10031009
1004 const stream_data = src[bytes_read .. bytes_read + total_streams_size];
1010 if (stream_data.len < 6) return error.MalformedLiteralsSection;
10051011
10061012 log.debug("jump table: {}", .{std.fmt.fmtSliceHexUpper(stream_data[0..6])});
10071013 const stream_1_length = @as(usize, readInt(u16, stream_data[0..2]));
......@@ -1014,6 +1020,7 @@ pub fn decodeLiteralsSection(src: []const u8, consumed_count: *usize) !LiteralsS
10141020 const stream_3_start = stream_2_start + stream_2_length;
10151021 const stream_4_start = stream_3_start + stream_3_length;
10161022
1023 if (stream_data.len < stream_4_start + stream_4_length) return error.MalformedLiteralsSection;
10171024 consumed_count.* += total_streams_size + bytes_read;
10181025
10191026 return LiteralsSection{
......@@ -1033,13 +1040,15 @@ pub fn decodeLiteralsSection(src: []const u8, consumed_count: *usize) !LiteralsS
10331040fn decodeHuffmanTree(src: []const u8, consumed_count: *usize) !LiteralsSection.HuffmanTree {
10341041 var bytes_read: usize = 0;
10351042 bytes_read += 1;
1043 if (src.len == 0) return error.MalformedHuffmanTree;
10361044 const header = src[0];
10371045 var symbol_count: usize = undefined;
10381046 var weights: [256]u4 = undefined;
10391047 var max_number_of_bits: u4 = undefined;
10401048 if (header < 128) {
1041 // FSE compressed weigths
1049 // FSE compressed weights
10421050 const compressed_size = header;
1051 if (src.len < 1 + compressed_size) return error.MalformedHuffmanTree;
10431052 var stream = std.io.fixedBufferStream(src[1 .. compressed_size + 1]);
10441053 var counting_reader = std.io.countingReader(stream.reader());
10451054 var bit_reader = bitReader(counting_reader.reader());
......@@ -1185,8 +1194,8 @@ fn lessThanByWeight(
11851194 return weights[lhs.symbol] < weights[rhs.symbol];
11861195}
11871196
1188pub fn decodeLiteralsHeader(src: []const u8, consumed_count: *usize) LiteralsSection.Header {
1189 // TODO: we probably want to enable safety for release-fast and release-small (or insert custom checks)
1197pub fn decodeLiteralsHeader(src: []const u8, consumed_count: *usize) !LiteralsSection.Header {
1198 if (src.len == 0) return error.MalformedLiteralsSection;
11901199 const start = consumed_count.*;
11911200 const byte0 = src[0];
11921201 const block_type = @intToEnum(LiteralsSection.BlockType, byte0 & 0b11);
......@@ -1201,14 +1210,16 @@ pub fn decodeLiteralsHeader(src: []const u8, consumed_count: *usize) LiteralsSec
12011210 consumed_count.* += 1;
12021211 },
12031212 1 => {
1213 if (src.len < 2) return error.MalformedLiteralsHeader;
12041214 regenerated_size = (byte0 >> 4) +
1205 (@as(u20, src[consumed_count.* + 1]) << 4);
1215 (@as(u20, src[1]) << 4);
12061216 consumed_count.* += 2;
12071217 },
12081218 3 => {
1219 if (src.len < 3) return error.MalformedLiteralsHeader;
12091220 regenerated_size = (byte0 >> 4) +
1210 (@as(u20, src[consumed_count.* + 1]) << 4) +
1211 (@as(u20, src[consumed_count.* + 2]) << 12);
1221 (@as(u20, src[1]) << 4) +
1222 (@as(u20, src[2]) << 12);
12121223 consumed_count.* += 3;
12131224 },
12141225 }
......@@ -1218,17 +1229,20 @@ pub fn decodeLiteralsHeader(src: []const u8, consumed_count: *usize) LiteralsSec
12181229 const byte2 = src[2];
12191230 switch (size_format) {
12201231 0, 1 => {
1232 if (src.len < 3) return error.MalformedLiteralsHeader;
12211233 regenerated_size = (byte0 >> 4) + ((@as(u20, byte1) & 0b00111111) << 4);
12221234 compressed_size = ((byte1 & 0b11000000) >> 6) + (@as(u18, byte2) << 2);
12231235 consumed_count.* += 3;
12241236 },
12251237 2 => {
1238 if (src.len < 4) return error.MalformedLiteralsHeader;
12261239 const byte3 = src[3];
12271240 regenerated_size = (byte0 >> 4) + (@as(u20, byte1) << 4) + ((@as(u20, byte2) & 0b00000011) << 12);
12281241 compressed_size = ((byte2 & 0b11111100) >> 2) + (@as(u18, byte3) << 6);
12291242 consumed_count.* += 4;
12301243 },
12311244 3 => {
1245 if (src.len < 5) return error.MalformedLiteralsHeader;
12321246 const byte3 = src[3];
12331247 const byte4 = src[4];
12341248 regenerated_size = (byte0 >> 4) + (@as(u20, byte1) << 4) + ((@as(u20, byte2) & 0b00111111) << 12);
......@@ -1257,6 +1271,7 @@ pub fn decodeLiteralsHeader(src: []const u8, consumed_count: *usize) LiteralsSec
12571271}
12581272
12591273pub fn decodeSequencesHeader(src: []const u8, consumed_count: *usize) !SequencesSection.Header {
1274 if (src.len == 0) return error.MalformedSequencesSection;
12601275 var sequence_count: u24 = undefined;
12611276
12621277 var bytes_read: usize = 0;
......@@ -1275,13 +1290,16 @@ pub fn decodeSequencesHeader(src: []const u8, consumed_count: *usize) !Sequences
12751290 sequence_count = byte0;
12761291 bytes_read += 1;
12771292 } else if (byte0 < 255) {
1293 if (src.len < 2) return error.MalformedSequencesSection;
12781294 sequence_count = (@as(u24, (byte0 - 128)) << 8) + src[1];
12791295 bytes_read += 2;
12801296 } else {
1297 if (src.len < 3) return error.MalformedSequencesSection;
12811298 sequence_count = src[1] + (@as(u24, src[2]) << 8) + 0x7F00;
12821299 bytes_read += 3;
12831300 }
12841301
1302 if (src.len < bytes_read + 1) return error.MalformedSequencesSection;
12851303 const compression_modes = src[bytes_read];
12861304 bytes_read += 1;
12871305