Repository navigation
Conversation
tbybell
pushed a commit
to gtkwave/libfst
that referenced
this pull request
Oct 15, 2026
* Build fastlz without the alignment sanitizer * Update fastlz to upstream master Update the vendored copy with `fastlz.c` and `fastlz.h` from the master branch of https://github.com/ariya/FastLZ at commit b1342da, from August 2024. The file is labeled as version 0.5.0, but that version was first released in February 2020. The vendored version before this commit was based on one from 2007. The new version bounds-checks the input, so it supersedes some of the checks previously introduced in this vendored copy. The new bounds checks cover more areas than the previous ones, but they still do not cover everything (this is fixed in the follow-up commit). * Bounds-check the two unchecked input reads in the decompressors (CWE-125 OOB read) Pulled from ariya/FastLZ#12, commit d29d1abeb1d503db15586788249011ea8a753b70. --------- Co-authored-by: Obi Ebuka David <davidobi023@gmail.com>
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bound-check the two unchecked input reads in the decompressors
fastlz_decompress()is documented as "crash-proof against corrupted and/or malicious data",and the decoders enforce that with the always-on
FASTLZ_BOUND_CHECKmacro. Two input reads aremissing that check, so a crafted/truncated stream reads one byte past the end of the input buffer
(CWE-125). A third read happens before the length is validated.
fastlz2_decompress— thecode = *ip++;right after theif (len == 7-1) do { ... } while (code == 255);loop has no bound check (it is the only one of the function's input reads withoutone). A 3-byte input
20 ff 38reaches it withipat the end of the buffer:fastlz1_decompress— the analogousref -= *ip++;after itsif (len == 7-1) { ...; len += *ip++; }block is likewise unchecked.fastlz_decompress— reads the level byte*(const uint8_t*)inputbefore checkinglength >= 1, so a zero-length call over-reads by one byte.Fix
Three lines, using the existing
FASTLZ_BOUND_CHECKmacro (this PR).Verification
cc -g -fsanitize=address poc.c fastlz.c && ./poc, PoC in the linked report): faultsbefore, clean after.
Found with a coverage-guided libFuzzer + ASan harness; happy to share it.