Skip to content

fix: update customDictContentEnd after ZDICT_finalizeDictionary in COVER_selectDict - #4769

Open
VirajMishra1 wants to merge 1 commit into
facebook:devfrom
VirajMishra1:fix-cover-stale-customdictcontentend
Open

fix: update customDictContentEnd after ZDICT_finalizeDictionary in COVER_selectDict#4769
VirajMishra1 wants to merge 1 commit into
facebook:devfrom
VirajMishra1:fix-cover-stale-customdictcontentend

Conversation

@VirajMishra1

Copy link
Copy Markdown

Problem

In COVER_selectDict (lib/dictBuilder/cover.c), customDictContentEnd is computed on line 1055 from the input dictContentSize:

BYTE* customDictContentEnd = customDictContent + dictContentSize;

Then on line 1069, ZDICT_finalizeDictionary() overwrites dictContentSize with the actual finalized dictionary size (input content plus the header). The two values can differ, so customDictContentEnd is now stale.

The stale pointer is used later in the shrinkDict loop:

dictContentSize = ZDICT_finalizeDictionary(
    candidateDictBuffer, dictBufferCapacity,
    customDictContentEnd - dictContentSize,   // ← offset computed from stale end
    dictContentSize, ...);

This produces a wrong source pointer for candidate dictionaries when shrinkDict is enabled.

Fix

Recompute customDictContentEnd immediately after ZDICT_finalizeDictionary() returns, once dictContentSize reflects the finalized value.

customDictContentEnd = customDictContent + dictContentSize;

Fixes #4750

…VER_selectDict

customDictContentEnd was computed from dictContentSize before the call
to ZDICT_finalizeDictionary(), which overwrites dictContentSize with the
actual finalized size (including the dictionary header). The stale pointer
was then used in the shrinkDict loop to compute candidate content slices,
referencing bytes past the true end of the custom content.

Fix: recompute customDictContentEnd immediately after the call, once
dictContentSize reflects the finalized value.

Fixes facebook#4750
@meta-cla meta-cla Bot added the CLA Signed label Sep 8, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

COVER_selectDict() uses stale customDictContentEnd after ZDICT_finalizeDictionary modifies dictContentSize

1 participant