@@ -314,19 +314,15 @@ typedef struct ZSTD_Cctx_s
314314#else
315315 U32 hashTable [HASH_TABLESIZE ];
316316#endif
317+ BYTE buffer [WORKPLACESIZE ];
317318} cctxi_t ;
318319
319320
320321ZSTD_Cctx * ZSTD_createCCtx (void )
321322{
322323 ZSTD_Cctx * ctx = (ZSTD_Cctx * ) malloc ( sizeof (ZSTD_Cctx ) );
323324 if (ctx == NULL ) return NULL ;
324- ctx -> seqStore .buffer = malloc (WORKPLACESIZE );
325- if (ctx -> seqStore .buffer == NULL )
326- {
327- free (ctx );
328- return NULL ;
329- }
325+ ctx -> seqStore .buffer = ctx -> buffer ;
330326 ctx -> seqStore .offsetStart = (U32 * ) (ctx -> seqStore .buffer );
331327 ctx -> seqStore .offCodeStart = (BYTE * ) (ctx -> seqStore .offsetStart + (BLOCKSIZE >>2 ));
332328 ctx -> seqStore .litStart = ctx -> seqStore .offCodeStart + (BLOCKSIZE >>2 );
@@ -344,7 +340,6 @@ void ZSTD_resetCCtx(ZSTD_Cctx* ctx)
344340
345341size_t ZSTD_freeCCtx (ZSTD_Cctx * ctx )
346342{
347- free (ctx -> seqStore .buffer );
348343 free (ctx );
349344 return 0 ;
350345}
@@ -1239,7 +1234,7 @@ size_t ZSTD_decodeLiteralsBlock(void* ctx,
12391234}
12401235
12411236
1242- size_t ZSTD_decodeSeqHeaders (int * nbSeq , const BYTE * * dumpsPtr ,
1237+ size_t ZSTD_decodeSeqHeaders (int * nbSeq , const BYTE * * dumpsPtr , size_t * dumpsLengthPtr ,
12431238 FSE_DTable * DTableLL , FSE_DTable * DTableML , FSE_DTable * DTableOffb ,
12441239 const void * src , size_t srcSize )
12451240{
@@ -1272,6 +1267,7 @@ size_t ZSTD_decodeSeqHeaders(int* nbSeq, const BYTE** dumpsPtr,
12721267 }
12731268 * dumpsPtr = ip ;
12741269 ip += dumpsLength ;
1270+ * dumpsLengthPtr = dumpsLength ;
12751271
12761272 /* check */
12771273 if (ip > iend - 3 ) return (size_t )- ZSTD_ERROR_SrcSize ; /* min : all 3 are "raw", hence no header, but at least xxLog bits per type */
@@ -1356,6 +1352,7 @@ typedef struct {
13561352 FSE_DState_t stateML ;
13571353 size_t prevOffset ;
13581354 const BYTE * dumps ;
1355+ const BYTE * dumpsEnd ;
13591356} seqState_t ;
13601357
13611358
@@ -1366,19 +1363,23 @@ static void ZSTD_decodeSequence(seq_t* seq, seqState_t* seqState)
13661363 size_t offset ;
13671364 size_t matchLength ;
13681365 const BYTE * dumps = seqState -> dumps ;
1366+ const BYTE * const de = seqState -> dumpsEnd ;
13691367
13701368 /* Literal length */
13711369 litLength = FSE_decodeSymbol (& (seqState -> stateLL ), & (seqState -> DStream ));
13721370 prevOffset = litLength ? seq -> offset : seqState -> prevOffset ;
13731371 seqState -> prevOffset = seq -> offset ;
13741372 if (litLength == MaxLL )
13751373 {
1376- U32 add = * dumps ++ ;
1374+ U32 add = dumps < de ? * dumps ++ : 0 ;
13771375 if (add < 255 ) litLength += add ;
13781376 else
13791377 {
1380- litLength = ZSTD_readLE32 (dumps ) & 0xFFFFFF ;
1381- dumps += 3 ;
1378+ if (dumps <=(de - 3 ))
1379+ {
1380+ litLength = ZSTD_readLE32 (dumps ) & 0xFFFFFF ; /* no pb : dumps is always followed by seq tables > 1 byte */
1381+ dumps += 3 ;
1382+ }
13821383 }
13831384 }
13841385
@@ -1398,12 +1399,15 @@ static void ZSTD_decodeSequence(seq_t* seq, seqState_t* seqState)
13981399 matchLength = FSE_decodeSymbol (& (seqState -> stateML ), & (seqState -> DStream ));
13991400 if (matchLength == MaxML )
14001401 {
1401- U32 add = * dumps ++ ;
1402+ U32 add = dumps < de ? * dumps ++ : 0 ;
14021403 if (add < 255 ) matchLength += add ;
14031404 else
14041405 {
1405- matchLength = ZSTD_readLE32 (dumps ) & 0xFFFFFF ; /* no pb : dumps is always followed by seq tables > 1 byte */
1406- dumps += 3 ;
1406+ if (dumps <=(de - 3 ))
1407+ {
1408+ matchLength = ZSTD_readLE32 (dumps ) & 0xFFFFFF ; /* no pb : dumps is always followed by seq tables > 1 byte */
1409+ dumps += 3 ;
1410+ }
14071411 }
14081412 }
14091413 matchLength += MINMATCH ;
@@ -1520,7 +1524,7 @@ static size_t ZSTD_decompressSequences(
15201524 BYTE * const ostart = (BYTE * const )dst ;
15211525 BYTE * op = ostart ;
15221526 BYTE * const oend = ostart + maxDstSize ;
1523- size_t errorCode ;
1527+ size_t errorCode , dumpsLength ;
15241528 const BYTE * litPtr = litStart ;
15251529 const BYTE * const litEnd = litStart + litSize ;
15261530 int nbSeq ;
@@ -1531,7 +1535,7 @@ static size_t ZSTD_decompressSequences(
15311535 BYTE * const base = (BYTE * ) (dctx -> base );
15321536
15331537 /* Build Decoding Tables */
1534- errorCode = ZSTD_decodeSeqHeaders (& nbSeq , & dumps ,
1538+ errorCode = ZSTD_decodeSeqHeaders (& nbSeq , & dumps , & dumpsLength ,
15351539 DTableLL , DTableML , DTableOffb ,
15361540 ip , iend - ip );
15371541 if (ZSTD_isError (errorCode )) return errorCode ;
@@ -1544,14 +1548,15 @@ static size_t ZSTD_decompressSequences(
15441548
15451549 memset (& sequence , 0 , sizeof (sequence ));
15461550 seqState .dumps = dumps ;
1551+ seqState .dumpsEnd = dumps + dumpsLength ;
15471552 seqState .prevOffset = 1 ;
15481553 errorCode = FSE_initDStream (& (seqState .DStream ), ip , iend - ip );
15491554 if (FSE_isError (errorCode )) return (size_t )- ZSTD_ERROR_corruption ;
15501555 FSE_initDState (& (seqState .stateLL ), & (seqState .DStream ), DTableLL );
15511556 FSE_initDState (& (seqState .stateOffb ), & (seqState .DStream ), DTableOffb );
15521557 FSE_initDState (& (seqState .stateML ), & (seqState .DStream ), DTableML );
15531558
1554- for ( ; (FSE_reloadDStream (& (seqState .DStream )) < FSE_DStream_completed ) || (nbSeq > 0 ) ; )
1559+ for ( ; (FSE_reloadDStream (& (seqState .DStream )) <= FSE_DStream_completed ) && (nbSeq > 0 ) ; )
15551560 {
15561561 size_t oneSeqSize ;
15571562 nbSeq -- ;
@@ -1562,7 +1567,7 @@ static size_t ZSTD_decompressSequences(
15621567 }
15631568
15641569 /* check if reached exact end */
1565- if (FSE_reloadDStream (& (seqState .DStream )) > FSE_DStream_completed ) return (size_t )- ZSTD_ERROR_corruption ; /* requested too much : data is corrupted */
1570+ if ( ! FSE_endOfDStream (& (seqState .DStream )) ) return (size_t )- ZSTD_ERROR_corruption ; /* requested too much : data is corrupted */
15661571 if (nbSeq < 0 ) return (size_t )- ZSTD_ERROR_corruption ; /* requested too many sequences : data is corrupted */
15671572
15681573 /* last literal segment */
0 commit comments