mirror of
https://github.com/aaru-dps/Aaru.Compression.Native.git
synced 2026-09-14 10:51:41 +00:00
Natalia Portillo
bbae748612
The shared English word dictionary was built behind a plain `if(dict_ptrs)` guard, which provides neither mutual exclusion nor memory ordering. Worse, dict_ptrs was published by malloc before the pointer table was populated, so a concurrent caller of the exported AARU_stuffitx_english_decode_buffer could pass the guard and read uninitialized pointers. Two racing threads would also both run the full PPMd decode, leaking the dictionary buffer. Build the dictionary in locals and publish the statics only once the table is complete, driven by pthread_once (POSIX) or InitOnceExecuteOnce (Windows), and record the outcome so a failed build is never retried. Also fix three adjacent issues in the same path: the word-scan loop dereferenced p before bounds-checking it, the base-52 index accumulator could overflow into a value that passed the bounds check, and the word buffer clamp left no room for the appended terminator character. Same class of bug as MacPaw/XADMaster#194.