Limit range of operations on Indexes in 32-bit mode #4129
Merged
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This is a mitigation strategy:
in 32-bit mode, when comparing pointers at very large distances, the result may eventually become negative, since
ptrdiff_t
is a signed 32-bit value. It happens if the distance is larger than 2 GB, which is technically possible, even if rare.This patch will reduce the range of possible distances in 32-bit mode to always remain < 2 GB.
Also, in
ZSTD_window_update()
, the operation is modified to useunsigned
type rather than signed, as it seems it could impact the outcome of a following comparison test. I'm unable to tell if this can lead to a bug, or just to a suboptimal decision, but it's suspicious enough that we don't want that to happen.Ultimately, I would also prefer to rewrite
ZSTD_window_update()
in a way which doesn't rely on pointer comparisons, and would therefore be less likely to land into UB territory (even if it works). But modifying that part has sprawling consequences across the entire compression code base, hence it's a much larger work, which will require more time.