Repository navigation
compress: fix input left pending with ZSTD_c_stableInBuffer - #4943
Merged
Merged
Conversation
With ZSTD_c_stableInBuffer, ZSTD_compressStream2() with ZSTD_e_continue can leave less than one block of input pending, counted in stableIn_notConsumed, before or after compression has started. ZSTD_CCtx_reset() did not clear it, so after an abandoned frame, the next frame started that many bytes before the new input buffer: it read out of bounds, and the frame contained those bytes. ZSTD_compress2() was affected too, since it starts with a session reset. Fixes #4868
The stable input buffer was checked against the pending input only when the call kept the input pending. A call that started compression, with ZSTD_e_flush, ZSTD_e_end or a full block of input, skipped the check. A different src pointer then made compression read before it, instead of failing with stabilityCondition_notRespected as documented. Disabling ZSTD_c_stableInBuffer while input is pending is now rejected too: that input was silently missing from the frame.
…stable input While input is pending before the first block, the parameters of the frame are not applied yet. inBuffer_forEndFlush() relied on them, so on a context whose previous frame did not use ZSTD_c_stableInBuffer, such as a new one, it passed an empty input instead of the stable buffer, and the frame failed with srcSize_wrong.
terrelln
approved these changes
Nov 12, 2026
Cyan4973
force-pushed
the
fix-4868-stablein-reset
branch
from
November 12, 2026 21:28
82bd60e to
c55665a
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #4868, reported by @IlyaGrebnov.
With
ZSTD_c_stableInBuffer,ZSTD_compressStream2()withZSTD_e_continuecan leave less than one block of input pending (stableIn_notConsumed), before or after compression has started. This PR fixes three problems with that pending input, one commit each:ZSTD_CCtx_reset()did not clear it. After an abandoned frame, the next frame started that many bytes before the new input buffer. It read up to 128 KB out of bounds, and the frame contained those bytes.ZSTD_compress2()was affected too, because it starts with a session reset.ZSTD_e_flush,ZSTD_e_end, or a full block) skipped the check. A differentsrcpointer then caused the same out-of-bounds read, instead ofstabilityCondition_notRespected. DisablingZSTD_c_stableInBufferwhile input was pending silently dropped that input from the frame; this is now rejected.ZSTD_flushStream()andZSTD_endStream()failed withsrcSize_wrongon pending input when the previous frame of the context did not useZSTD_c_stableInBuffer, for example on a new context.Each commit adds a test to
zstreamtestthat fails without it.Only programs that set
ZSTD_c_stableInBuffer(experimental API) reach these paths. The pending-input logic was added in c1668a0, first released in v1.5.4.