airlift / aircompressor

A port of Snappy, LZO, LZ4, and Zstandard to Java
Apache License 2.0
568 stars 113 forks source link

Fix out of bounds read/write in Snappy decompressor #184

Closed martint closed 8 months ago

martint commented 8 months ago

In the slow literal copy path, it wasn't validating that the literal fit within the input buffer, so the call to copyMemory could read from out of bounds and cause a crash.

When copying a match, it wasn't validating that the match fit within the output buffer in both branches (slow & fast path), so the operation could write outside of the output buffer if the match length was corrupted.

Fixes #183