From 9c1860861ef15891f60510f9d4c3d6a75da2e12f Mon Sep 17 00:00:00 2001 From: Nick Terrell Date: Mon, 28 Oct 2019 17:51:17 -0700 Subject: [PATCH] Fix assert in ZSTD_safecopy In the case that `op >= oend_w` it is possible that `diff < 8` because the two buffers could be adjacent. Credit to OSS-Fuzz, which found the bug. It isn't reproducible because it depends on the memory layout. --- lib/decompress/zstd_decompress_block.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/decompress/zstd_decompress_block.c b/lib/decompress/zstd_decompress_block.c index cbb66c8d..767e5f9a 100644 --- a/lib/decompress/zstd_decompress_block.c +++ b/lib/decompress/zstd_decompress_block.c @@ -617,7 +617,7 @@ static void ZSTD_safecopy(BYTE* op, BYTE* const oend_w, BYTE const* ip, ptrdiff_ ptrdiff_t const diff = op - ip; BYTE* const oend = op + length; - assert((ovtype == ZSTD_no_overlap && (diff <= -8 || diff >= 8)) || + assert((ovtype == ZSTD_no_overlap && (diff <= -8 || diff >= 8 || op >= oend_w)) || (ovtype == ZSTD_overlap_src_before_dst && diff >= 0)); if (length < 8) {