indygreg / indygreg/python-zstandard
`multi_decompress_to_buffer([])` terminates the process with SIGFPE
Nobody has claimed this yet.
- Dominant language
- C
- Stars
- 642
- Forks
- 116
- Avg merge
- 1d 14h
- Merged PRs (30d)
- 5
Description
I've been fuzzing Python C extension modules for a small research project, and this one came up.
It reproduces with the binary wheel from a plain `pip install zstandard`.
### Versions
zstandard 0.25.0 C backend, CPython 3.12.3, Ubuntu 24.04 x86_64, glibc 2.39.
### Reproducer
```python
import zstandard
zstandard.ZstdDecompressor().multi_decompress_to_buffer([])
```
An UBSan build identifies a division by zero at `c-ext/decompressor.c:1237`.
I would expect an empty frame list to return an empty result or raise an exception rather than terminate the interpreter.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start at c-ext/decompressor.c:1237 and run the provided empty-list reproducer, preferably with UBSan, to inspect the division-by-zero path. Check nearby decompression tests and add coverage for an empty frame list; done means it returns an empty result or raises an exception without terminating the interpreter.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- c, python
- Domain
- api, backend
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Active
- Clarity
- Clearly specified
- Newbie friendliness
- 78/100