Skip to content

Fix LZ4 decompressor data leak when match offset is zero#307

Merged
martint merged 1 commit intoairlift:masterfrom
martint:lz4-leak
Dec 10, 2025
Merged

Fix LZ4 decompressor data leak when match offset is zero#307
martint merged 1 commit intoairlift:masterfrom
martint:lz4-leak

Conversation

@martint
Copy link
Member

@martint martint commented Dec 9, 2025

When match offset is zero, the decompressor copies pre-existing data from the decompression buffer.

When match offset is zero, the decompressor copies
pre-existing data from the decompression buffer.
@martint martint merged commit f2b489b into airlift:master Dec 10, 2025
2 checks passed
@martint martint deleted the lz4-leak branch December 10, 2025 00:03
@Marcono1234
Copy link

Marcono1234 commented Dec 10, 2025

Note that the native LZ4 implementation seems to behave differently in this case and just emits 0s when the offset is 0. Even though the specification says 0 is an invalid offset. See also lz4/lz4#1631.

So the question is if compatibility is a concern for this (probably) rare invalid input.

CC @simonresch @kyakdan

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants