From f85f528c78f4ec3dc692e9620fcd9582e847ac71 Mon Sep 17 00:00:00 2001 From: Saleem Malik Date: Wed, 22 Jul 2026 12:53:40 +0530 Subject: [PATCH] fix off-by-one bounds check in ZSTD_seekTable_getFrameDecompressedSize --- contrib/seekable_format/tests/seekable_tests.c | 4 ++++ contrib/seekable_format/zstdseek_decompress.c | 2 +- 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/contrib/seekable_format/tests/seekable_tests.c b/contrib/seekable_format/tests/seekable_tests.c index 809ea6425eb..4ada5d60958 100644 --- a/contrib/seekable_format/tests/seekable_tests.c +++ b/contrib/seekable_format/tests/seekable_tests.c @@ -121,6 +121,10 @@ int main(int argc, const char** argv) size_t const origSize = ZSTD_seekTable_getFrameDecompressedSize(zst, 0); assert(origSize == inSize); + /* out-of-range frame index must be rejected, not read past the table */ + assert(ZSTD_isError(ZSTD_seekTable_getFrameCompressedSize(zst, nbFrames))); + assert(ZSTD_isError(ZSTD_seekTable_getFrameDecompressedSize(zst, nbFrames))); + unsigned const fo1idx = ZSTD_seekTable_offsetToFrameIndex(zst, 1); assert(fo1idx == 0); diff --git a/contrib/seekable_format/zstdseek_decompress.c b/contrib/seekable_format/zstdseek_decompress.c index ab9088a1061..633e496e801 100644 --- a/contrib/seekable_format/zstdseek_decompress.c +++ b/contrib/seekable_format/zstdseek_decompress.c @@ -366,7 +366,7 @@ size_t ZSTD_seekable_getFrameDecompressedSize(const ZSTD_seekable* zs, unsigned size_t ZSTD_seekTable_getFrameDecompressedSize(const ZSTD_seekTable* st, unsigned frameIndex) { - if (frameIndex > st->tableLen) return ERROR(frameIndex_tooLarge); + if (frameIndex >= st->tableLen) return ERROR(frameIndex_tooLarge); return st->entries[frameIndex + 1].dOffset - st->entries[frameIndex].dOffset; }