root
root copied to clipboard
Lack of size validation in ZSTD compression
- [x] Checked for duplicates
Describe the bug
The size validation is missing in https://github.com/root-project/root/blob/master/core/zstd/src/ZipZSTD.cxx line 47. This leads to invalid stream in case of sizes between 0x1000000 and 0xffffffff as only the 3 last bytes of the length are put in the encoded data.
Expected behavior
The size should be checked as done in https://github.com/root-project/root/blob/master/core/lzma/src/ZipLZMA.c line 40 to 42
To Reproduce
Just try to deflate something of size > 0xffffff