From: Asjid Kalam Date: Thu, 10 Sep 2026 19:29:31 +0000 (+0400) Subject: IMPORT: uslz: reject codes from an empty distance table X-Git-Tag: v3.5-dev7~24 X-Git-Url: https://git.kaiwu.me/?a=commitdiff_plain;h=1c8625e0e2584cb04e683c897b2316c99048ee5e;p=haproxy.git IMPORT: uslz: reject codes from an empty distance table gen_huffman_table() may be asked to accept a table with no symbol at all (allow_no_symbols, the distance table). It used to return success without initializing the table, but that storage aliases the persistent header-detection buffer (hdr_detect), so gethuff() could walk header bytes out of bounds. Make the two root entries terminal with an out-of-range symbol so any code decoded against an empty table is rejected. Reported-by: Asjid Kalam (cherry picked from commit d97d31c2a7246d4faf53baa64b5f50aa895f7706) Signed-off-by: Willy Tarreau This is libslz upstream commit cab751dc4858a6c6510f5cebf7ad0dd5deaca244 --- diff --git a/src/uslz.c b/src/uslz.c index 1e7a8f9e9..043a37238 100644 --- a/src/uslz.c +++ b/src/uslz.c @@ -107,8 +107,20 @@ static int gen_huffman_table(unsigned int symbols, for (i = 1; i < 16; i++) total_count += length_count[i]; - if (total_count == 0) - return allow_no_symbols; + if (total_count == 0) { + if (!allow_no_symbols) + return 0; + /* No symbol at all: the table is deliberately left empty by the + * caller, but its storage may alias the persistent header-detection + * buffer (see hdr_detect in struct uslz_stream). Make the two root + * entries terminal with an out-of-range symbol so that any code + * decoded against this table is rejected instead of making gethuff() + * walk stale/aliased memory. + */ + table[0] = 0x7fff; + table[1] = 0x7fff; + return 1; + } else if (total_count == 1) { for (i = 0; i < symbols; i++) { if (lengths[i] != 0) {