facebook/zstd

Cross-border access?

QiAnXinCodeSafe opened this issue · 1 comments

Hi all,
This is Qianxin CodeSafe Team, we found a suspicious issue, at

U32 const repCode = OFFBASE_TO_REPCODE(offBase) - 1 + ll0;

where 'repCode' is initialized to 4294967295,and
U32 const currentOffset = (repCode==ZSTD_REP_NUM) ? (rep[0] - 1) : rep[repCode];

In the statement "rep[repCode]", the access to memory exceeded the upper limit of the memory block, causing an out-of-bounds access

where 'repCode' is initialized to 4294967295,and

For that outcome to happen, it would require offbase == 0.
This is not possible. offbase is always >= 1.
This condition is even asserted within the macro.