deflate.zig: check for distances past beginning of output stream#9860
deflate.zig: check for distances past beginning of output stream#9860andrewrk merged 1 commit intoziglang:masterfrom
Conversation
|
Nice work, this was something I was looking into as well but didn't understand well enough to properly fix. I was trying to use |
|
The window is a simple circular buffer holding the last N bytes that have been decompressed. It's how copies from backward references are implemented (thus if you want to support the maximum backward distance of 32768, make sure the window buffer is at least 32K). Since it's circular, after the first N bytes have been decompressed, byte N+1 will overwrite byte 0, N+2 will over write byte 1, etc. Obviously, we don't want to do this until those old bytes have actually been read out by the user of |
InflateStreamdoesn't check if the distance in a backward reference extends past the beginning of the decompressed "output stream". For example, if the first block starts by encoding the literals 'A', 'B', and 'C' followed a (length, distance) pair of (4, 4), we will reach one byte past the beginning of the output stream. This will output "ABCxABC" where x is a garbage byte (in this case, whatever happened to be in the last slot of the window buffer). This should not be allowed according to the RFC, and the reference implementation in Mark Adler'spuff.cchecks for this as well. The fix is simply to havewindowkeep track of the total number of bytes written out, independent of the number of unread elements inel.