[filtede98]

Summary

This PR addresses two security and stability defects in lib/dictBuilder/cover.c and lib/dictBuilder/fastcover.c:

1. Unchecked trainingSamplesSize Integer Underflow & Buffer Overflow:
   In COVER_ctx_init() and FASTCOVER_ctx_init(), totalSamplesSize is verified against MAX(d, sizeof(U64)), but trainingSamplesSize is never checked.
   When splitPoint < 1.0 (which is standard practice and the default in FASTCOVER where FASTCOVER_DEFAULT_SPLITPOINT = 0.75), trainingSamplesSize is calculated solely from the sum of the first nbTrainSamples samples.
   If trainingSamplesSize < MAX(d, sizeof(U64)), calculating:

   • In cover.c: ctx->suffixSize = trainingSamplesSize - MAX(d, sizeof(U64)) + 1;
   • In fastcover.c: ctx->nbDmers = trainingSamplesSize - MAX(d, sizeof(U64)) + 1;
     causes unsigned integer underflow on size_t (e.g. 5 - 8 + 1 wraps around to SIZE_MAX - 1). In cover.c, this results in an oversized allocation or integer multiplication overflow in malloc(ctx->suffixSize * sizeof(U32)), followed by an out-of-bounds heap write loop in ctx->suffix[i] = i;. In fastcover.c, ctx->nbDmers wrapping leads to out-of-bounds loop bounds and crashes.

2. Hardware Division by Zero in COVER_computeEpochs():
   In COVER_computeEpochs():

   • If k == 0 or passes == 0, maxDictSize / k / passes causes a SIGFPE division by zero.
   • If nbDmers == 0, epochs.size = MIN(minEpochSize, nbDmers) evaluates to 0, causing a SIGFPE division by zero on epochs.num = nbDmers / epochs.size.
   • Furthermore, epochs.num is now guaranteed to be >= 1, preventing any downstream modulo-by-zero crashes in for (epoch = 0; tail > 0; epoch = (epoch + 1) % epochs.num).

Changes

• Reject trainingSamplesSize < MAX(d, sizeof(U64)) in both COVER_ctx_init() and FASTCOVER_ctx_init() with ERROR(srcSize_wrong).
• Harden COVER_computeEpochs() to safely handle zero values for k, passes, nbDmers, and epochs.size, ensuring epochs.num >= 1.
• Add regression tests in tests/fuzzer.c to verify that ZDICT_optimizeTrainFromBuffer_cover() and ZDICT_optimizeTrainFromBuffer_fastCover() properly reject inputs with underflowing training sample sizes.

[filtede98]

Closing. I tried the case this describes (cover and fastCover, splitPoint 0.75,
samples of 1, 1, 1 and 100 bytes, so the training part is shorter than d) on
dev with ASan and both return an error ("Src size is incorrect") instead of
underflowing. k == 0 and passes == 0 are rejected earlier by the parameter
checks. Sorry for the noise.