[libzstd] Fix infinite loop in decompression
When we switched `ZSTD_SKIPPABLEHEADERSIZE` to a macro, the places where we do: MEM_readLE32(ptr) + ZSTD_SKIPPABLEHEADERSIZE can now overflow `(unsigned)-8` to `0` and we infinite loop. We now check the frame size and reject sizes that overflow a U32. Note that this bug never made it into a release, and was only in the dev branch for a few days. Credit to OSS-Fuzz
Loading
Please register or sign in to comment