Buffer bounds about zstd

[Cyan4973]

Hi Luben

Yes that's correct. Zstd is not yet protected against buffer overflow, hence not ready for production usage.

The first error surprised me : ZSTD_compress() is supposed to be protected against overflow, because it requires maxDstSize >= ZSTD_compressBound(rawSize).
But looking at the code, it seems this protection was removed during one of the refactoring exercise. Not a huge deal, since this protection is supposed to be temporary, but as long as the definitive solution is not avaiable, it should stay around, so I'll update the code to re-instate that condition.

ZSTD_decompress(), on the other hand, is more difficult to protect. So it will require a bit more time to get there.

Best Regards

[Cyan4973]

Latest version in "dev" branch seems to correctly prevent buffer overflow during compression.
On the other hand, decompression side still needs to be done.

For the record, here is my slightly modified version of your very useful test program :

#include <stdio.h>
#include <stdlib.h>
#include "zstd.h"

#define SAMPLE_SIZE 1000
#define CBUFF_SIZE (ZSTD_compressBound(SAMPLE_SIZE)) 
#define DBUFF_SIZE (SAMPLE_SIZE-100)
int main(int argc, char **argv ) {
    char *raw = (char *)malloc(SAMPLE_SIZE);
    char compressed[CBUFF_SIZE];
    char decompressed[DBUFF_SIZE];
    size_t i, ccode, dcode;

    // fill it with ones
    for (i=0; i<1000; i++) raw[i] = 1;

    ccode = ZSTD_compress(compressed, 20, raw, SAMPLE_SIZE);
    printf("Max 20 : Compression code %zu\n", ccode);   /* will correctly return an error code */
    ccode = ZSTD_compress(compressed, CBUFF_SIZE, raw, SAMPLE_SIZE);
    printf("Max CBUFF_SIZE : Compression code %zu\n", ccode);
    dcode = ZSTD_decompress(decompressed, DBUFF_SIZE, compressed, ccode);   /* will smash the stack */
    printf("Decompression code %zu\n", dcode);
    return 0;
}

[Cyan4973]

By the way, the decoding side of this issue seems technically the same as #11. Maybe we should fold both issues into one.

[Cyan4973]

Merged this issue into #11