lz4 SIGSEGV in LZ4_decompress_generic

Problem is more complex. When receive incomplete frame, decompression context need to be reset with LZ4F_resetDecompressionContext (added in lz4 1.8.0).

I add simple port

void LZ4F_resetDecompressionContext(LZ4F_dctx* dctx)
{
    dctx->dStage = dstage_getHeader;
    dctx->dict = NULL;
    dctx->dictSize = 0;
}

And with first patch problem was solved.

@Michail Do you have a full patch against e.g. disco sources / version?

Patches for Ubuntu Bionic (and Debian Stretch)

For Ubuntu Xenial last patches also work

For Ubuntu Cosmic (lz4-1.8.2)

For Ubuntu Disco (lz4-1.8.3)

Ubuntu Focal and Debian Buster not affected - in lz4 1.9 all problems already fixed.

Some correction - for Debian Buster patch needed

The attachment "lz4-1.8.2-null-check-in-lz4-decompress.patch" seems to be a patch. If it isn't, please remove the "patch" flag from the attachment, remove the "patch" tag, and if you are a member of the ~ubuntu-reviewers, unsubscribe the team.

[This is an automated message performed by a Launchpad user owned by ~brian-murray, for any issues please contact him.]

The bug description mentions a corrupt stream. For the Stable Release Update we will need a test case to ensure that the bug is fixed. Could you help us out creating a test case with a corrupt stream? Thanks in advance.

Hello. Bug was found when work on commpression in carbon-c-relay

https://github.com/msaf1980/carbon-c-relay/tree/fix_compress

For reproduce

$
git clone https://github.com/msaf1980/carbon-c-relay
cd carbon-c-relay
git checkout fix_compress

autoreconf -fi
./configure -with-lz4 --without-gzip --without-snappy --without-ssl
make clean
make -j 4 test

LZ4F_resetDecompressionContext is required for recovery lz4 decompression context after try to decompress imcomplete block in frame.

If you need see a segfault, comment call LZ4F_resetDecompressionContext(strm->hdl.lz4.lz) at dispatcher.c:381

This patch looks like it adds a public symbol, but doesn't add it to liblz4-1.symbols? What mechanism does this have to ensure that code built against the new symbol gets a compatible version of liblz4-1?

An upload of lz4 to xenial-proposed has been rejected from the upload queue for the following reason: "Possible missing symbols file entry; see comment 12".

An upload of lz4 to bionic-proposed has been rejected from the upload queue for the following reason: "Possible missing symbols file entry; see comment 12".