Skip to content

🔒 Fix uninitialized memory exposure via set_len #422

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
404Setup wants to merge 2 commits into from
Closed

🔒 Fix uninitialized memory exposure via set_len #422

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
c8324e7
🔒 Fix uninitialized memory exposure via set_len
404Setup Apr 12, 2026
0a38a7d
🔒 Fix uninitialized memory exposure and Adler-32 overflow
404Setup Apr 12, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions src/adler32/arm.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,7 +28,7 @@ pub unsafe fn adler32_arm_neon(adler: u32, p: &[u8]) -> u32 {
];

while data.len() > 0 {
let n = std::cmp::min(data.len(), 5504) & !63;
let n = std::cmp::min(data.len(), 4032) & !63;
if n == 0 {
break;
}
Expand Down Expand Up @@ -118,7 +118,7 @@ pub unsafe fn adler32_arm_neon_dotprod(adler: u32, p: &[u8]) -> u32 {
let ones = vdupq_n_u8(1);

while data.len() > 0 {
let n = std::cmp::min(data.len(), 5504) & !63;
let n = std::cmp::min(data.len(), 4032) & !63;
if n == 0 {
break;
}
Expand Down
23 changes: 4 additions & 19 deletions src/adler32/mod.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@ use std::cmp::min;
use std::sync::OnceLock;

const DIVISOR: u32 = 65521;
const MAX_CHUNK_LEN: usize = 4096;
const MAX_CHUNK_LEN: usize = 4032;

#[inline]
fn adler32_chunk(s1: &mut u32, s2: &mut u32, p: &[u8]) {
Expand Down Expand Up @@ -30,7 +30,7 @@ fn adler32_chunk(s1: &mut u32, s2: &mut u32, p: &[u8]) {
let b14 = unsafe { *ptr.add(14) as u32 };
let b15 = unsafe { *ptr.add(15) as u32 };

s2_local += (s1_local << 4)
s2_local += (s1_local * 16)
+ (b0 * 16)
+ (b1 * 15)
+ (b2 * 14)
Expand All @@ -57,21 +57,6 @@ fn adler32_chunk(s1: &mut u32, s2: &mut u32, p: &[u8]) {
len -= 16;
}

while len >= 4 {
let b0 = unsafe { *ptr.add(0) as u32 };
let b1 = unsafe { *ptr.add(1) as u32 };
let b2 = unsafe { *ptr.add(2) as u32 };
let b3 = unsafe { *ptr.add(3) as u32 };

s2_local += (s1_local << 2) + (b0 * 4) + (b1 * 3) + (b2 * 2) + b3;
s1_local += b0 + b1 + b2 + b3;

unsafe {
ptr = ptr.add(4);
}
len -= 4;
}

while len > 0 {
let b = unsafe { *ptr as u32 };
s1_local += b;
Expand Down Expand Up @@ -104,10 +89,10 @@ pub fn adler32_generic(adler: u32, mut buffer: &[u8]) -> u32 {
}

#[cfg(any(target_arch = "x86", target_arch = "x86_64"))]
mod x86;
pub mod x86;

#[cfg(any(target_arch = "arm", target_arch = "aarch64"))]
mod arm;
pub mod arm;

type Adler32Fn = unsafe fn(u32, &[u8]) -> u32;

Expand Down
8 changes: 4 additions & 4 deletions src/adler32/x86.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@ use core::arch::x86::*;
use core::arch::x86_64::*;

const DIVISOR: u32 = 65521;
const BLOCK_SIZE: usize = 4096;
const BLOCK_SIZE: usize = 4032;

macro_rules! adler32_chunk8 {
($s1:expr, $s2:expr, $ptr:expr, $len:expr) => {
Expand Down Expand Up @@ -576,7 +576,7 @@ pub unsafe fn adler32_x86_avx2(adler: u32, p: &[u8]) -> u32 {
s1 %= DIVISOR;
s2 %= DIVISOR;

(s2 << 16) | s1
(s2 % DIVISOR) << 16 | (s1 % DIVISOR)
}

#[target_feature(enable = "avxvnni")]
Expand Down Expand Up @@ -850,7 +850,7 @@ pub unsafe fn adler32_x86_avx2_vnni(adler: u32, p: &[u8]) -> u32 {
s1 %= DIVISOR;
s2 %= DIVISOR;

(s2 << 16) | s1
(s2 % DIVISOR) << 16 | (s1 % DIVISOR)
}

#[cfg(target_arch = "x86_64")]
Expand Down Expand Up @@ -1103,5 +1103,5 @@ pub unsafe fn adler32_x86_avx512_vnni(adler: u32, p: &[u8]) -> u32 {
s1 %= DIVISOR;
s2 %= DIVISOR;

(s2 << 16) | s1
(s2 % DIVISOR) << 16 | (s1 % DIVISOR)
}
13 changes: 8 additions & 5 deletions src/batch.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -63,15 +63,18 @@ impl BatchDecompressor {
.map_init(
|| (Decompressor::new(), Vec::new()),
|(decompressor, buffer), (&input, &max_size)| {
buffer.clear();
if buffer.capacity() < max_size {
buffer.reserve(max_size.saturating_sub(buffer.len()));
}
unsafe {
buffer.set_len(max_size);
buffer.reserve(max_size);
}
let buf_uninit = &mut buffer.spare_capacity_mut()[..max_size];

let (res, _, size) = decompressor.decompress(input, buffer);
let (res, _, size) = unsafe { decompressor.decompress_uninit(input, buf_uninit) };
buffer.clear();
if res == DecompressResult::Success {
unsafe {
buffer.set_len(size);
}
Some(buffer[..size].to_vec())
} else {
None
Expand Down
28 changes: 9 additions & 19 deletions src/compress/mod.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -683,28 +683,28 @@ impl Compressor {
let mode = if is_last { flush_mode } else { FlushMode::Sync };

let bound = Self::deflate_compress_bound(chunk.len());
buf.clear();
if buf.capacity() < bound {
buf.reserve(bound - buf.len());
}
unsafe {
buf.set_len(bound);
buf.reserve(bound);
}

let buf_uninit = slice_as_uninit_mut(buf);
let buf_uninit = &mut buf.spare_capacity_mut()[..bound];

let (res, size, _) = compressor.compress(chunk, buf_uninit, mode);
if res == CompressResult::Success {
unsafe {
buf.set_len(size);
}
if size < buf.capacity() / 2 {
let result = if size < buf.capacity() / 2 {
Ok(buf.to_vec())
} else {
Ok(std::mem::replace(
buf,
Vec::with_capacity(chunk_size + chunk_size / 2),
))
}
};
buf.clear();
result
} else {
Err(io::Error::other("Compression failed"))
}
Expand Down Expand Up @@ -920,12 +920,7 @@ impl Compressor {
self.dp_costs[0] = 0;

self.dp_path.clear();
if self.dp_path.capacity() < processed + 1 {
self.dp_path.reserve(processed + 1 - self.dp_path.len());
}
unsafe {
self.dp_path.set_len(processed + 1);
}
self.dp_path.resize(processed + 1, 0);

mf.reset();
let mut pos = 0;
Expand Down Expand Up @@ -1717,12 +1712,7 @@ impl Compressor {
self.dp_costs[0] = 0;

self.dp_path.clear();
if self.dp_path.capacity() < processed + 1 {
self.dp_path.reserve(processed + 1 - self.dp_path.len());
}
unsafe {
self.dp_path.set_len(processed + 1);
}
self.dp_path.resize(processed + 1, 0);

mf.reset();
let mut pos = 0;
Expand Down
57 changes: 30 additions & 27 deletions src/stream.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -65,23 +65,24 @@ impl<W: Write + Send> DeflateEncoder<W> {
if !final_block {
bound += 5;
}
if output.len() < bound {
output
.try_reserve(bound - output.len())
.map_err(io::Error::other)?;
unsafe {
output.set_len(bound);
}
}

output.clear();
output
.try_reserve(bound)
.map_err(io::Error::other)?;

let mode = if final_block {
crate::compress::FlushMode::Finish
} else {
crate::compress::FlushMode::Sync
};
let out_uninit = crate::common::slice_as_uninit_mut(output);
let out_uninit = &mut output.spare_capacity_mut()[..bound];
let (res, size, _) = compressor.compress(chunk, out_uninit, mode);
output.clear();
if res == CompressResult::Success {
unsafe {
output.set_len(size);
}
if let Some(writer) = &mut self.writer {
writer.write_all(&output[..size])?;
}
Expand All @@ -99,23 +100,24 @@ impl<W: Write + Send> DeflateEncoder<W> {
if !(final_block && i == num_chunks - 1) {
bound += 5;
}
if output.len() < bound {
output
.try_reserve(bound - output.len())
.map_err(io::Error::other)?;
unsafe {
output.set_len(bound);
}
}

output.clear();
output
.try_reserve(bound)
.map_err(io::Error::other)?;

let mode = if final_block && i == num_chunks - 1 {
crate::compress::FlushMode::Finish
} else {
crate::compress::FlushMode::Sync
};
let out_uninit = crate::common::slice_as_uninit_mut(output);
let out_uninit = &mut output.spare_capacity_mut()[..bound];
let (res, size, _) = compressor.compress(chunk, out_uninit, mode);
output.clear();
if res == CompressResult::Success {
unsafe {
output.set_len(size);
}
Ok(size)
} else {
Err(io::Error::other("Compression failed"))
Expand Down Expand Up @@ -144,23 +146,24 @@ impl<W: Write + Send> DeflateEncoder<W> {
if !final_block {
bound += 5;
}
if output.len() < bound {
output
.try_reserve(bound - output.len())
.map_err(io::Error::other)?;
unsafe {
output.set_len(bound);
}
}

output.clear();
output
.try_reserve(bound)
.map_err(io::Error::other)?;

let mode = if final_block {
crate::compress::FlushMode::Finish
} else {
crate::compress::FlushMode::Sync
};
let out_uninit = crate::common::slice_as_uninit_mut(output);
let out_uninit = &mut output.spare_capacity_mut()[..bound];
let (res, size, _) = compressor.compress(&self.buffer, out_uninit, mode);
output.clear();
if res == CompressResult::Success {
unsafe {
output.set_len(size);
}
if let Some(writer) = &mut self.writer {
writer.write_all(&output[..size])?;
}
Expand Down
Binary file added test_adler_all
View file
Open in desktop
Binary file not shown.
36 changes: 36 additions & 0 deletions test_adler_all.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,36 @@
use std::cmp::min;

const DIVISOR: u32 = 65521;
const MAX_CHUNK_LEN: usize = 4032;

fn adler32_chunk(s1: &mut u32, s2: &mut u32, p: &[u8]) {
let mut s1_local = *s1;
let mut s2_local = *s2;
for &b in p {
s1_local += b as u32;
s2_local += s1_local;
}
*s1 = s1_local % DIVISOR;
*s2 = s2_local % DIVISOR;
}

fn adler32_generic(adler: u32, mut buffer: &[u8]) -> u32 {
let mut s1 = adler & 0xFFFF;
let mut s2 = adler >> 16;
let mut len = buffer.len();
while len > 0 {
let n = min(len, MAX_CHUNK_LEN);
let (chunk, rest) = buffer.split_at(n);
buffer = rest;
len -= n;
adler32_chunk(&mut s1, &mut s2, chunk);
}
(s2 % DIVISOR) << 16 | (s1 % DIVISOR)
}

fn main() {
let size = 100000;
let data = vec![0xFF; size];
let expected = adler32_generic(1, &data);
println!("Expected: {}", expected);
}
Binary file added test_adler_all_v2
View file
Open in desktop
Binary file not shown.
67 changes: 67 additions & 0 deletions test_adler_all_v2.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,67 @@
use std::cmp::min;

const DIVISOR: u32 = 65521;
const MAX_CHUNK_LEN: usize = 4032;

fn adler32_chunk(s1: &mut u32, s2: &mut u32, p: &[u8]) {
let mut s1_local = *s1;
let mut s2_local = *s2;
let mut ptr = p.as_ptr();
let mut len = p.len();
while len >= 16 {
let b0 = unsafe { *ptr.add(0) as u32 };
let b1 = unsafe { *ptr.add(1) as u32 };
let b2 = unsafe { *ptr.add(2) as u32 };
let b3 = unsafe { *ptr.add(3) as u32 };
let b4 = unsafe { *ptr.add(4) as u32 };
let b5 = unsafe { *ptr.add(5) as u32 };
let b6 = unsafe { *ptr.add(6) as u32 };
let b7 = unsafe { *ptr.add(7) as u32 };
let b8 = unsafe { *ptr.add(8) as u32 };
let b9 = unsafe { *ptr.add(9) as u32 };
let b10 = unsafe { *ptr.add(10) as u32 };
let b11 = unsafe { *ptr.add(11) as u32 };
let b12 = unsafe { *ptr.add(12) as u32 };
let b13 = unsafe { *ptr.add(13) as u32 };
let b14 = unsafe { *ptr.add(14) as u32 };
let b15 = unsafe { *ptr.add(15) as u32 };
s2_local += (s1_local * 16)
+ (b0 * 16) + (b1 * 15) + (b2 * 14) + (b3 * 13)
+ (b4 * 12) + (b5 * 11) + (b6 * 10) + (b7 * 9)
+ (b8 * 8) + (b9 * 7) + (b10 * 6) + (b11 * 5)
+ (b12 * 4) + (b13 * 3) + (b14 * 2) + b15;
s1_local += b0 + b1 + b2 + b3 + b4 + b5 + b6 + b7 + b8 + b9 + b10 + b11 + b12 + b13 + b14 + b15;
unsafe { ptr = ptr.add(16); }
len -= 16;
}
while len > 0 {
let b = unsafe { *ptr as u32 };
s1_local += b;
s2_local += s1_local;
unsafe { ptr = ptr.add(1); }
len -= 1;
}
*s1 = s1_local % DIVISOR;
*s2 = s2_local % DIVISOR;
}

fn adler32_generic(adler: u32, mut buffer: &[u8]) -> u32 {
let mut s1 = adler & 0xFFFF;
let mut s2 = adler >> 16;
let mut len = buffer.len();
while len > 0 {
let n = min(len, MAX_CHUNK_LEN);
let (chunk, rest) = buffer.split_at(n);
buffer = rest;
len -= n;
adler32_chunk(&mut s1, &mut s2, chunk);
}
(s2 % DIVISOR) << 16 | (s1 % DIVISOR)
}

fn main() {
let size = 100000;
let data = vec![0xFF; size];
let actual = adler32_generic(1, &data);
println!("Actual: {}", actual);
}
Binary file added test_final
View file
Open in desktop
Binary file not shown.
Loading
Loading