Cyan4973 / Cyan4973/FiniteStateEntropy

FSE_compressU16() computes clipped data if dstCapacity different

Open
#97 1 comment 1 reaction 0 assignees View on GitHub
Dominant language
C
Stars
1.5k
Forks
165
PR merge metrics
No merged PRs in 30d

Description

Repro:

```
constexpr size_t inSize = 24;
uint16_t in[inSize] =
{0, 0, 3, 2, 0, 0, 0, 0, 314, 0, 0, 0, 0, 51, 50, 0, 0, 59, 22, 36, 0, 55, 32, 22};
unsigned int maxSymbolValue = 314;
unsigned int outSize = 48;

uint8_t out1[256];
uint8_t out2[256];
size_t numBytes1 = FSE_compressU16(out1,
outSize,
in,
inSize,
maxSymbolValue,
0);

size_t numBytes2 = FSE_compressU16(out2,
256,
in,
inSize,
maxSymbolValue,
0);
// numBytes1 is now 34 bytes
// numBytes2 is now 43 bytes

FSE_decompressU16(in, inSize, out2, numBytes2);
FSE_decompressU16(in, inSize, out1, numBytes1); // <- Crashes
```
When output bytes is 48 rather than 256 as an argument for FSE_compressU16(), all generated bytes are identical up until 34 bytes. The rest of the bytes are clipped. The difference in code paths is that in the 34 bytes case, the non-fast path is chosen.

Contributor guide

No contributing guide indexed for this repository

Research direction

Start with the FSE_compressU16() entry point and reproduce the issue using the code in the report with dstCapacity set to 48 and 256. Compare the fast and non-fast paths, then verify that both capacities produce complete, safely decompressible output rather than clipped data.

Written by the indexing model from the issue text.

Assessment

Tech stack
c
Domain
performance
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.