Memory stomp due to libdeflate_gdeflate_compress_bound returning too small of a value and libdeflate_gdeflate_compress ignoring the output limit

Open

#41 opened on Jun 3, 2024 3 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty: 4/5
Estimated time: 3-5 days
Newbie friendliness: 35/100

Issue type: Bug
Clarity: Mostly clear
Activity status: Stale
Tech stack: cpp
Domain: backend

Research direction

Start by reproducing the crash with GDeflateDemo in debug mode using the attached gdeflatecrash.bin, then inspect libdeflate_gdeflate_compress_bound and libdeflate_gdeflate_compress. Done means the reported bound is sufficient and compression no longer writes beyond the supplied output limit for this reproduction.

Written by the indexing model from the issue text.

Description

While running some tests, GDeflateDemo crashed due to stack corruption. Upon testing, it turns out that this was due to libdeflate_gdeflate_compress writing more data than libdeflate_gdeflate_compress_bound indicated was the upper limit.

Reproduction steps:

Extract "gdeflatecrash.bin" from the attached file
Compile GDeflateDemo in debug mode so stack corruption checks are enabled
Run GDeflateDemo /compress gdeflatecrash.bin .

gdeflatecrash.zip

Dominant language: C++
Stars: 897
Forks: 111
Avg merge: 13h 58m
Merged PRs (30d): 12

Contributor guide

No contributing guide indexed for this repository

First steps

Read the whole issue, then the project's contributing guide.
Comment on the issue to say you are picking it up — it saves two people doing the same work.
Fork the repository and make your change on a branch.
Open a pull request that references the issue number.

Similar issues

rate_limit_sni_expiry AuTest is flaky: the holder races FIFO removal Open

AuTest Bug Tests

Difficulty 2/5 1-3 hours Newbie friendliness 78/100

apache/trafficserver#13714 · Opened Sep 22, 2026
[CI] Nightly Clang build broken: ToJsonFunction no longer binds to registerFunction Open

bug build

Difficulty 2/5 1-3 hours Newbie friendliness 88/100

facebookincubator/velox#19143 · Opened Sep 22, 2026
Misc. bug: Vulkan: ggml_backend_vk_get_device_memory reports free > total when the driver's heapBudget exceeds heap size (Intel iGPU, Windows); downstream consumers underflow Open

Difficulty 2/5 1-3 hours Newbie friendliness 82/100

ggml-org/llama.cpp#29277 · Opened Sep 22, 2026
tt_metal/hw/inc/internal/tt-2xx/quasar/overlay/xcustom_test.hpp needs reimplementing Open

Difficulty 2/5 1-3 hours Newbie friendliness 68/100

tenstorrent/tt-metal#57393 · 1 comment · Opened Sep 22, 2026
Ford-Fulkerson entry point sizes the graph by argument count, not by vertex id range, so it crashes on any vertex id >= args.length Open

Difficulty 2/5 1-3 hours Newbie friendliness 76/100

objectionary/eo-graphs#74 · Opened Sep 22, 2026

More C++ issues