diff --git a/lib/zstd.c b/lib/zstd.c index b93cca4ee..462b335a0 100644 --- a/lib/zstd.c +++ b/lib/zstd.c @@ -1172,7 +1172,12 @@ static size_t ZSTD_decompressLiterals(void* ctx, BYTE* const oend = op + maxDstSize; const BYTE* ip = (const BYTE*)src; size_t errorCode; - size_t litSize = ip[1] + (ip[0]<<8); + size_t litSize; + + /* check : minimum 2, for litSize, +1, for content */ + if (srcSize <= 3) return (size_t)-ZSTD_ERROR_corruption; + + litSize = ip[1] + (ip[0]<<8); litSize += ((ip[-3] >> 3) & 7) << 16; // mmmmh.... op = oend - litSize; diff --git a/programs/datagencli.c b/programs/datagencli.c index 2665c54bd..ce581bafc 100644 --- a/programs/datagencli.c +++ b/programs/datagencli.c @@ -81,7 +81,7 @@ static int usage(char* programName) { DISPLAY( "Compressible data generator\n"); DISPLAY( "Usage :\n"); - DISPLAY( " %s [size] [args]\n", programName); + DISPLAY( " %s [args]\n", programName); DISPLAY( "\n"); DISPLAY( "Arguments :\n"); DISPLAY( " -g# : generate # data (default:%i)\n", SIZE_DEFAULT); diff --git a/programs/fileio.c b/programs/fileio.c index c137c78ba..d1c4a7c7f 100644 --- a/programs/fileio.c +++ b/programs/fileio.c @@ -354,19 +354,21 @@ unsigned long long FIO_decompressFilename(const char* output_filename, const cha size_t readSize, decodedSize; /* Fill input buffer */ + if (toRead > inBuffSize) + EXM_THROW(34, "too large block"); readSize = fread(inBuff, 1, toRead, finput); if (readSize != toRead) - EXM_THROW(34, "Read error"); + EXM_THROW(35, "Read error"); /* Decode block */ decodedSize = ZSTD_decompressContinue(dctx, op, oend-op, inBuff, readSize); - if (ZSTD_isError(decodedSize)) EXM_THROW(35, "Decoding error : input corrupted"); + if (ZSTD_isError(decodedSize)) EXM_THROW(36, "Decoding error : input corrupted"); if (decodedSize) /* not a header */ { /* Write block */ sizeCheck = fwrite(op, 1, decodedSize, foutput); - if (sizeCheck != decodedSize) EXM_THROW(36, "Write error : unable to write data block to destination file"); + if (sizeCheck != decodedSize) EXM_THROW(37, "Write error : unable to write data block to destination file"); filesize += decodedSize; op += decodedSize; if (op==oend) op = outBuff;