Repository navigation
Fix COVER_selectDict() stale customDictContentEnd (heap OOB read) - #4798
ceedot-rock wants to merge 1 commit into
Conversation
|
Hi @ceedot-rock! Thank you for your pull request and welcome to our community. Action RequiredIn order to merge any pull request (code, docs, etc.), we require contributors to sign our Contributor License Agreement, and we don't seem to have one on file for you. ProcessIn order for us to review and merge your suggested changes, please sign at https://code.facebook.com/cla. If you are contributing on behalf of someone else (eg your employer), the individual CLA may not be sufficient and your employer may need to sign the corporate CLA. Once the CLA is signed, our tooling will perform checks and validations. Afterwards, the pull request will be tagged with If you have received this in error or have any questions, please contact us at cla@meta.com. Thanks! |
|
Thank you for signing our Contributor License Agreement. We can now accept your code for this (and any) Meta Open Source project. Thanks! |
COVER_selectDict() computed customDictContentEnd from the input content size, then let ZDICT_finalizeDictionary() overwrite dictContentSize with the larger finalized size (content + header). The shrinkDict loop used that finalized size as its bound while passing customDictContentEnd - dictContentSize as candidate content, so a tried size between the content size and the finalized size made the pointer underflow the content buffer (heap-buffer-overflow read). Bound the loop by the content size instead. Adds a reproducer test that sweeps content sizes through COVER_selectDict with shrinkDict enabled.
6b5426d to
0d1ea94
Compare
Fixes #4750.
In COVER_selectDict() (lib/dictBuilder/cover.c), customDictContentEnd is computed from the input content size S0, but the shrinkDict trial loop is bounded by largestDict, the finalized dictionary size S1 (about S0+154). Any tried size in (S0, S1) underflows the content buffer, and ZDICT_finalizeDictionary() then reads out of bounds in XXH64 (zdict.c:883).
The fix is one line plus a comment: bound the trial loop by the content size instead of the finalized size.
Reproducer (tests/test-cover-selectdict-stale.c, sweeps sizes 240-2000): fails 3/3 pre-fix under ASan with a deterministic heap-buffer-overflow READ, passes post-fix, ASan/UBSan clean. Existing dictBuilder tests (169, 170, 172, 174 incl. shrinkDict) and 200 fuzzer iterations pass with zero failures. fastcover.c doesn't share the pattern - untouched.
Slid Phi Labs accepts donations to keep the lab independent.