Repository navigation
Update FastLZ and fix remaining memory safety issues in it - #22
Merged
Merged
Conversation
Update the vendored copy with `fastlz.c` and `fastlz.h` from the master branch of https://github.com/ariya/FastLZ at commit b1342da, from August 2024. The file is labeled as version 0.5.0, but that version was first released in February 2020. The vendored version before this commit was based on one from 2007. The new version bounds-checks the input, so it supersedes some of the checks previously introduced in this vendored copy. The new bounds checks cover more areas than the previous ones, but they still do not cover everything (this is fixed in the follow-up commit).
…125 OOB read) Pulled from ariya/FastLZ#12, commit d29d1abeb1d503db15586788249011ea8a753b70.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
One of the bugs that I found in the work I mentioned in #20 was actually in FastLZ. Some of the bugs were already fixed upstream, so I updated the vendored copy with the latest version, but there were still some issues remaining. So I pulled the change from ariya/FastLZ#12, which fixed them.
Additionally, I added
-fno-sanitize=alignmenttofastlz.cbecause the sanitizer would otherwise trigger on intentional unaligned reads performed by FastLZ. Currently no tests trigger this, but I am unsure if the tests I am adding in other PRs might. I previously had some tests that trigger it, but I removed them when I realized they were actually testing FastLZ itself rather than this project.