fse: Fix max header size (#881)

In rare cases the FSE may be calculated too small. Fixes: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=64014 Replace fuzz corpus with one with better base coverage.
klauspost · Nov 9, 2023 · 847c1b4 · 847c1b4
1 parent dc4151f
commit 847c1b4
Show file tree

Hide file tree

Showing 3 changed files with 2 additions and 2 deletions.
diff --git a/fse/compress.go b/fse/compress.go
@@ -212,7 +212,7 @@ func (s *Scratch) writeCount() error {
 		previous0 bool
 		charnum   uint16
 
-		maxHeaderSize = ((int(s.symbolLen) * int(tableLog)) >> 3) + 3
+		maxHeaderSize = ((int(s.symbolLen)*int(tableLog) + 4 + 2) >> 3) + 3
 
 		// Write Table Size
 		bitStream = uint32(tableLog - minTablelog)

diff --git a/fse/fuzz_test.go b/fse/fuzz_test.go
@@ -9,7 +9,7 @@ import (
 )
 
 func FuzzCompress(f *testing.F) {
-	fuzz.AddFromZip(f, "testdata/fse_compress.zip", fuzz.TypeRaw, false)
+	fuzz.AddFromZip(f, "testdata/fse_compress.zip", fuzz.TypeGoFuzz, false)
 	f.Fuzz(func(t *testing.T, buf0 []byte) {
 		var s, s2 Scratch
 		b, err := Compress(buf0, &s)

diff --git a/fse/testdata/fse_compress.zip b/fse/testdata/fse_compress.zip