Cyan4973 / Cyan4973/FiniteStateEntropy
FSE_compressU16() computes clipped data if dstCapacity different
- Dominant language
- C
- Stars
- 1.5k
- Forks
- 165
- PR merge metrics
- No merged PRs in 30d
Description
Repro:
```
constexpr size_t inSize = 24;
uint16_t in[inSize] =
{0, 0, 3, 2, 0, 0, 0, 0, 314, 0, 0, 0, 0, 51, 50, 0, 0, 59, 22, 36, 0, 55, 32, 22};
unsigned int maxSymbolValue = 314;
unsigned int outSize = 48;
uint8_t out1[256];
uint8_t out2[256];
size_t numBytes1 = FSE_compressU16(out1,
outSize,
in,
inSize,
maxSymbolValue,
0);
size_t numBytes2 = FSE_compressU16(out2,
256,
in,
inSize,
maxSymbolValue,
0);
// numBytes1 is now 34 bytes
// numBytes2 is now 43 bytes
FSE_decompressU16(in, inSize, out2, numBytes2);
FSE_decompressU16(in, inSize, out1, numBytes1); // <- Crashes
```
When output bytes is 48 rather than 256 as an argument for FSE_compressU16(), all generated bytes are identical up until 34 bytes. The rest of the bytes are clipped. The difference in code paths is that in the 34 bytes case, the non-fast path is chosen.
Contributor guide
No contributing guide indexed for this repository
Research direction
Start with the FSE_compressU16() entry point and reproduce the issue using the code in the report with dstCapacity set to 48 and 256. Compare the fast and non-fast paths, then verify that both capacities produce complete, safely decompressible output rather than clipped data.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- c
- Domain
- performance
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 25/100