facebook / facebook/zstd

Potential Divide-by-zero in function FIO_compressLzmaFrame

Open
#4,393 1 comment 1 reaction 0 assignees View on GitHub
Dominant language
C
Stars
27.9k
Forks
2.6k
Avg merge
1d 3h
Merged PRs (30d)
8

Description

Hi,

In `FIO_compressLzmaFrame`, the variable `inFileSize` starts at 0 and is incremented by the return value of:

```c
size_t const inSize = AIO_ReadPool_fillBuffer(ress->readCtx, ZSTD_CStreamInSize());
if (ress->readCtx->srcBufferLoaded == 0) action = LZMA_FINISH;
inFileSize += inSize;
```

However, `AIO_ReadPool_fillBuffer()` can return 0 when no data is available (for example, when `ctx->srcBufferLoaded >= n` or `AIO_ReadPool_releaseCurrentHeldAndGetNext()` returns `NULL`). In that case, `inFileSize` remains 0, so later:

```c
(double)outFileSize / (double)inFileSize * 100
```

can perform a divide-by-zero.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.