starred/brotli
1
0
Fork 0
mirror of https://github.com/google/brotli.git synced 2026-07-09 02:08:06 +00:00
Code Issues 1.2k Packages Projects Releases 20 Wiki Activity

Fix #502 decoder bug (#505)

Browse Source 
Decoder may have produced invalid output if:
 * at offset 0..3 dictionary word with index 3..0 for some length N is used
   and distance is encoded with direct distance code 0, and
 * at least one of next 4 commands use value from distance ringbuffer
This commit is contained in:
Eugene Kliuchnikov
2017-02-07 15:35:03 +01:00
committed by GitHub
parent 11df843cf0
commit 0749d9ca8b
1 changed files with 6 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
dec/decode.c
View File

@@ -1391,6 +1391,8 @@ static BROTLI_INLINE void TakeDistanceFromRingBuffer(BrotliDecoderState* s) {
if (s->distance_code == 0) {
--s->dist_rb_idx;
s->distance_code = s->dist_rb[s->dist_rb_idx & 3];
/* Compensate double distance-ring-buffer roll for dictionary items. */
s->distance_context = 1;
} else {
int distance_code = s->distance_code << 1;
/* kDistanceShortCodeIndexOffset has 2-bit values from LSB: */
@@ -1712,6 +1714,8 @@ CommandPostDecodeLiterals:
if (BROTLI_PREDICT_FALSE(s->block_length[2] == 0)) {
BROTLI_SAFE(DecodeDistanceBlockSwitch(s));
}
/* Reuse distance_context variable. */
s->distance_context = 0;
BROTLI_SAFE(ReadDistance(s, br));
postReadDistance:
BROTLI_LOG(("[ProcessCommandsInternal] pos = %d distance = %d\n",
@@ -1732,6 +1736,8 @@ postReadDistance:
int mask = (int)BitMask(shift);
int word_idx = word_id & mask;
int transform_idx = word_id >> shift;
/* Compensate double distance-ring-buffer roll. */
s->dist_rb_idx += s->distance_context;
offset += word_idx * i;
if (transform_idx < kNumTransforms) {
const uint8_t* word = &kBrotliDictionary[offset];