Check length before copy

klauspost · Sep 8, 2022 · 1d40a91 · 1d40a91
1 parent 099f285
commit 1d40a91
Show file tree

Hide file tree

Showing 2 changed files with 16 additions and 16 deletions.
diff --git a/huff0/decompress.go b/huff0/decompress.go
@@ -763,21 +763,20 @@ func (d *Decoder) decompress4X8bit(dst, src []byte) ([]byte, error) {
 				d.bufs.Put(buf)
 				return nil, errors.New("corruption detected: stream overrun 1")
 			}
+			// There must at least be 3 buffers left.
+			if len(out) < dstEvery*3-bufoff {
+				d.bufs.Put(buf)
+				return nil, errors.New("corruption detected: stream overrun 2")
+			}
 			//copy(out, buf[0][:])
 			//copy(out[dstEvery:], buf[1][:])
 			//copy(out[dstEvery*2:], buf[2][:])
-			//copy(out[dstEvery*3:], buf[3][:])
 			*(*[bufoff]byte)(out) = buf[0]
 			*(*[bufoff]byte)(out[dstEvery:]) = buf[1]
 			*(*[bufoff]byte)(out[dstEvery*2:]) = buf[2]
 			*(*[bufoff]byte)(out[dstEvery*3:]) = buf[3]
 			out = out[bufoff:]
 			decoded += bufoff * 4
-			// There must at least be 3 buffers left.
-			if len(out) < dstEvery*3 {
-				d.bufs.Put(buf)
-				return nil, errors.New("corruption detected: stream overrun 2")
-			}
 		}
 	}
 	if off > 0 {
@@ -1001,6 +1000,12 @@ func (d *Decoder) decompress4X8bitExactly(dst, src []byte) ([]byte, error) {
 				d.bufs.Put(buf)
 				return nil, errors.New("corruption detected: stream overrun 1")
 			}
+			// There must at least be 3 buffers left.
+			if len(out) < dstEvery*3-bufoff {
+				d.bufs.Put(buf)
+				return nil, errors.New("corruption detected: stream overrun 2")
+			}
+
 			//copy(out, buf[0][:])
 			//copy(out[dstEvery:], buf[1][:])
 			//copy(out[dstEvery*2:], buf[2][:])
@@ -1011,11 +1016,6 @@ func (d *Decoder) decompress4X8bitExactly(dst, src []byte) ([]byte, error) {
 			*(*[bufoff]byte)(out[dstEvery*3:]) = buf[3]
 			out = out[bufoff:]
 			decoded += bufoff * 4
-			// There must at least be 3 buffers left.
-			if len(out) < dstEvery*3 {
-				d.bufs.Put(buf)
-				return nil, errors.New("corruption detected: stream overrun 2")
-			}
 		}
 	}
 	if off > 0 {

diff --git a/huff0/decompress_generic.go b/huff0/decompress_generic.go
@@ -122,6 +122,11 @@ func (d *Decoder) Decompress4X(dst, src []byte) ([]byte, error) {
 				d.bufs.Put(buf)
 				return nil, errors.New("corruption detected: stream overrun 1")
 			}
+			// There must at least be 3 buffers left.
+			if len(out) < dstEvery*3-bufoff {
+				d.bufs.Put(buf)
+				return nil, errors.New("corruption detected: stream overrun 2")
+			}
 			//copy(out, buf[0][:])
 			//copy(out[dstEvery:], buf[1][:])
 			//copy(out[dstEvery*2:], buf[2][:])
@@ -132,11 +137,6 @@ func (d *Decoder) Decompress4X(dst, src []byte) ([]byte, error) {
 			*(*[bufoff]byte)(out[dstEvery*3:]) = buf[3]
 			out = out[bufoff:]
 			decoded += bufoff * 4
-			// There must at least be 3 buffers left.
-			if len(out) < dstEvery*3 {
-				d.bufs.Put(buf)
-				return nil, errors.New("corruption detected: stream overrun 2")
-			}
 		}
 	}
 	if off > 0 {