Repository navigation
Conversation
In dictBuilder interfaces, callers providing NULL buffers or sample size arrays could cause NULL pointer dereferences prior to capacity validation: 1. ZDICT_getDictID() and ZDICT_getDictHeaderSize() did not verify whether dictBuffer was non-NULL before reading magic headers with MEM_readLE32. 2. ZDICT_totalSampleSize() and COVER_sum() did not guard against NULL pointers in the sample size array, and lacked overflow protection when accumulating total sample sizes. 3. ZDICT_trainFromBuffer_legacy() did not validate dictBuffer, samplesBuffer, or samplesSizes before reading sizes, and did not check for integer overflow before allocating the noisy guard band. 4. COVER_ctx_init() and FASTCOVER_ctx_init() calculated sample sums and advanced size pointers before validating samplesBuffer or samplesSizes. 5. ZDICT_trainFromBuffer_cover(), ZDICT_optimizeTrainFromBuffer_cover(), ZDICT_trainFromBuffer_fastCover(), and ZDICT_optimizeTrainFromBuffer_fastCover() did not validate that dictBuffer was non-NULL before proceeding with dictionary generation. Add defensive checks for NULL input pointers, add arithmetic overflow guards during sample size aggregation, and add regression tests in tests/fuzzer.c. Signed-off-by: Filippo Tedeschi <filippotedeschi98@gmail.com>
Author
|
Closing. This adds NULL / overflow checks for arguments the callers are not |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
In lib/dictBuilder/ interfaces, callers providing NULL buffers or sample size arrays could cause NULL pointer dereferences before capacity validation. Additionally, sample size accumulation lacked overflow protection against SIZE_MAX.
This change introduces defensive NULL pointer validation and arithmetic bounds guards across zdict.c, cover.c, and astcover.c.
Details
ZDICT_getDictID() and ZDICT_getDictHeaderSize() (lib/dictBuilder/zdict.c):
Verify that dictBuffer is non-NULL prior to reading the dictionary magic header via MEM_readLE32.
ZDICT_totalSampleSize() (lib/dictBuilder/zdict.c) and COVER_sum() (lib/dictBuilder/cover.c):
Return early if ileSizes or samplesSizes is NULL. Guard the running total against size_t overflow during sample size accumulation.
ZDICT_trainFromBuffer_legacy() (lib/dictBuilder/zdict.c):
Validate that dictBuffer, samplesBuffer, and samplesSizes are non-NULL before processing. Ensure sBuffSize + NOISELENGTH does not overflow size_t before memory allocation.
COVER_ctx_init() and FASTCOVER_ctx_init() (lib/dictBuilder/cover.c, lib/dictBuilder/fastcover.c):
Validate samplesBuffer and samplesSizes at the function entry point before calculating sample size sums or advancing array pointers.
ZDICT_trainFromBuffer_cover(), ZDICT_optimizeTrainFromBuffer_cover(), ZDICT_trainFromBuffer_fastCover(), ZDICT_optimizeTrainFromBuffer_fastCover():
Ensure dictBuffer is non-NULL alongside existing capacity validation.
Regression Tests ( ests/fuzzer.c):
Add test coverage verifying that ZDICT_getDictID() and ZDICT_getDictHeaderSize() safely handle NULL buffer inputs.
Verification
All modifications pass git diff --check cleanly with zero whitespace defects.