Negative array access on state->mtf for InverseMoveToFrontTransform #101

New Issue

claunia · 2026-01-29T20:34:45Z

claunia commented

2026-01-29 20:34:45 +00:00

Originally created by @danielrh on GitHub (Apr 18, 2016).

When decoding quickfox_repeated.compressed
The local variable index can start off zero, which will result in an access to s.mtf[-1]
https://github.com/google/brotli/blob/master/dec/decode.c#L881

Since the previous variable in the struct is a 32 bit integer mtf_upper_bound, and usually little endian < 2^24, this generally results in a zero access.

I believe this could exhibit itself as an issue on big endian systems and could be undefined behavior nevertheless. I think it would be more intuitive to restructure the code to avoid out of bounds access.

Originally created by @danielrh on GitHub (Apr 18, 2016). When decoding quickfox_repeated.compressed The local variable `index` can start off zero, which will result in an access to s.mtf[-1] https://github.com/google/brotli/blob/master/dec/decode.c#L881 Since the previous variable in the struct is a 32 bit integer mtf_upper_bound, and usually little endian < 2^24, this generally results in a zero access. I believe this could exhibit itself as an issue on big endian systems and could be undefined behavior nevertheless. I think it would be more intuitive to restructure the code to avoid out of bounds access.

claunia referenced this issue

2026-01-29 20:50:27 +00:00

[PR #101] Add an Acknowledgements section to the spec. #706

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: starred/brotli#101