diff options
author | Alexey Tourbin <alexey.tourbin@gmail.com> | 2018-04-22 22:43:30 (GMT) |
---|---|---|
committer | Alexey Tourbin <alexey.tourbin@gmail.com> | 2018-04-22 23:13:49 (GMT) |
commit | ab06ef97bb5bb50f642add1e80854a09c3d38068 (patch) | |
tree | f7682234ceaebb92935573c386600488e627fa19 /tests | |
parent | 62d7cdcc741480842a0c217df7cb26ad3946ab32 (diff) | |
download | lz4-ab06ef97bb5bb50f642add1e80854a09c3d38068.zip lz4-ab06ef97bb5bb50f642add1e80854a09c3d38068.tar.gz lz4-ab06ef97bb5bb50f642add1e80854a09c3d38068.tar.bz2 |
lz4.h: clarify the risks of using LZ4_decompress_fast()
The notes about "security guarantee" and "malicious inputs" seemed
a bit non-technical to me, so I took the liberty to tone them down
and instead describe the actual risks in technical terms. Namely,
the function never writes past the end of the output buffer, so
a direct hostile takeover (resulting in arbitrary code execution
soon after the return from the function) is not possible. However,
the application can crash because of reads from unmapped pages.
I also took the liberty to describe what I believe is the only sensible
usage scenario for the function: "This function is only usable if the
originalSize of uncompressed data is known in advance," etc.
Diffstat (limited to 'tests')
0 files changed, 0 insertions, 0 deletions