Missing check on failed allocation leads to NULL-ptr dereference #4026
Comments
Adenilson
pushed a commit
to Adenilson/zstd
that referenced
this issue
May 17, 2024
As reported by Ben Hawkes in facebook#4026, a failure to allocate a zstd context would lead to a dereference of a NULL pointer due to a missing check on the returned result of ZSTDv06_createDCtx(). This patch fix the issue by adding a check for valid returned pointer.
|
Seems like an one-liner fix, just added a patch for it. |
Adenilson
pushed a commit
to Adenilson/zstd
that referenced
this issue
May 17, 2024
As reported by Ben Hawkes in facebook#4026, a failure to allocate a zstd context would lead to a dereference of a NULL pointer due to a missing check on the returned result of ZSTDv06_createDCtx(). This patch fix the issue by adding a check for valid returned pointer.
Adenilson
pushed a commit
to Adenilson/zstd
that referenced
this issue
May 17, 2024
As reported by Ben Hawkes in facebook#4026, a failure to allocate a zstd context would lead to a dereference of a NULL pointer due to a missing check on the returned result of ZSTDv06_createDCtx(). This patch fix the issue by adding a check for valid returned pointer.
Adenilson
pushed a commit
to Adenilson/zstd
that referenced
this issue
May 17, 2024
As reported by Ben Hawkes in facebook#4026, a failure to allocate a zstd context would lead to a dereference of a NULL pointer due to a missing check on the returned result of ZSTDv06_createDCtx(). This patch fix the issue by adding a check for valid returned pointer.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Describe the bug
In the ZBUFFv06_createDCtx function in lib/legacy/zstd_v06.c, there is an unchecked allocation failure that can result in a NULL-ptr dereference when calling ZSTD_decompressStream in low-memory conditions. Specifically the following line in ZBUFFv06_createDCtx is unchecked:
zbd->zd = ZSTDv06_createDCtx();If this allocation fails, a NULL-ptr deference in ZSTDv06_decompressBegin (via ZSTDv06_decompressBegin_usingDict) can be observed.
It looks like there are similar cases in lib/legacy/zstd_v05.c and lib/legacy/zstd_v04.c
The text was updated successfully, but these errors were encountered: