Cyan4973 / Cyan4973/FiniteStateEntropy

NULL pointer dereference in BIT_reloadDStream()

Open
#96 7 comments 1 reaction 0 assignees View on GitHub
Dominant language
C
Stars
1.5k
Forks
165
PR merge metrics
No merged PRs in 30d

Description

Crashing line:
430: bitD->bitContainer = MEM_readLEST(bitD->ptr);
in bitstream.h in the function BIT_reloadDStream()
triggered by FSE_decompressU16() with the following code:
```
const uint8_t* casted2 = (uint8_t*)"Àâ(¢x(Kùÿÿcb¿\a";
uint16_t out[256];
size_t ret = FSE_decompressU16(out, 256, casted2, 14);
```

This is caused by
size_t const NSize = FSE_readNCount (NCount, &maxSymbolValue, &tableLog, istart, cSrcSize);
returning zero in the following block of FSE_decompressU16():

> { size_t const NSize = FSE_readNCount (NCount, &maxSymbolValue, &tableLog, istart, cSrcSize);
> if (FSE_isError(NSize)) return NSize;
> ip += NSize;
> cSrcSize -= NSize;
> }
thus, resulting in a zero cSrcSize when entering FSE_decompressU16_usingDTable() which is unexpected

I don't know if this can happen in the 8 bit version.

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.