Skip to content

compression: handle zero-length NUQ decompression - #1062

Merged
copybara-service[bot] merged 1 commit into
google:devfrom
Subhan1794:fix-nuq-zero-length-dev
Oct 19, 2026
Merged

copybara-service[bot] merged 1 commit into
google:devfrom
Subhan1794:fix-nuq-zero-length-dev

Conversation

@Subhan1794

Copy link
Copy Markdown

Fix heap-buffer-overflow in NuqCodec::DecompressAndZeroPad when num == 0.

This retargets #1052 to the dev branch per maintainer request (Jan Wassenberg). Single commit, no rebase.

When num == 0 with an aligned packed_ofs, num_groups computes to 0 and
num_groups - 1 wraps to SIZE_MAX, causing DecWholeGroup to write 256
floats out of bounds (ASan heap-buffer-overflow WRITE).

Return early on num == 0, mirroring the existing guard in
IntCodec::DecompressAndZeroPad (compression/int-inl.h).

Add TestZeroNum regression test: calls DecompressAndZeroPad with num=0
over a sentinel-filled buffer and verifies it is untouched. The test
crashes under ASan without the fix and passes with it.

@jan-wassenberg jan-wassenberg left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for retargeting and fixing!

@jan-wassenberg jan-wassenberg added the copybara-import Trigger Copybara for merging pull requests label Oct 19, 2026
@copybara-service
copybara-service Bot merged commit 98ef1e6 into google:dev Oct 19, 2026
8 of 13 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

copybara-import Trigger Copybara for merging pull requests

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants