Possible Integer overflow #440

New Issue

claunia · 2026-01-29T20:43:56Z

claunia commented

2026-01-29 20:43:56 +00:00

Originally created by @BruceYChien on GitHub (Nov 2, 2022).

Hi,

When I look at the source code of brotli/c/enc/compress_fragment_two_pass.c line 463, it occurs to me that the insert might encounter integer overflow. As the variable "insert" is equal to (uint32_t)(ip_end - next_emit), the ip_end and next_emit is a pointer which might be 64 bit in 64 bit machine. In this case, the ip_end - next_emit might overflow to a small number when ip_end - next_emit is larger than the 32 bit max value. This might cause the memcpy to copy only partial value of the source "next_emit" to the dest "*literals".

Originally created by @BruceYChien on GitHub (Nov 2, 2022). Hi, When I look at the source code of brotli/c/enc/compress_fragment_two_pass.c line 463, it occurs to me that the insert might encounter integer overflow. As the variable "insert" is equal to (uint32_t)(ip_end - next_emit), the ip_end and next_emit is a pointer which might be 64 bit in 64 bit machine. In this case, the ip_end - next_emit might overflow to a small number when ip_end - next_emit is larger than the 32 bit max value. This might cause the memcpy to copy only partial value of the source "next_emit" to the dest "*literals".

claunia closed this issue

2026-01-29 20:43:56 +00:00

claunia commented

2026-01-29 20:43:57 +00:00

@eustas commented on GitHub (Dec 29, 2022):

Will take a look at this soon. Thanks for the report.

@eustas commented on GitHub (Dec 29, 2022): Will take a look at this soon. Thanks for the report.

claunia commented

2026-01-29 20:43:57 +00:00

@eustas commented on GitHub (Dec 29, 2022):

Initially:

const uint8_t* ip = input;
const uint8_t* next_emit = input;  
const uint8_t* ip_end = input + block_size;

In the loop ip grows, and sometimes next_emit is assigned ip. Consequently, difference is less than block_size which is less than kCompressFragmentTwoPassBlockSize (128K).

@eustas commented on GitHub (Dec 29, 2022): Initially: ``` const uint8_t* ip = input; const uint8_t* next_emit = input; const uint8_t* ip_end = input + block_size; ``` In the loop `ip` grows, and sometimes `next_emit` is assigned `ip`. Consequently, difference is less than `block_size` which is less than `kCompressFragmentTwoPassBlockSize` (128K).

claunia referenced this issue

2026-01-29 20:52:19 +00:00

[PR #440] [MERGED] CMake: Also add ARCHIVE DESTINATION for non-WIN32 #1057

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: starred/brotli#440