Merge pull request #54055 from thaJeztah/29.x_backport_bump_compress [docker-29.x backport] vendor: github.com/klauspost/compress v1.20.2
diff --git a/go.mod b/go.mod index 5268b6d..8f546c3 100644 --- a/go.mod +++ b/go.mod
@@ -231,7 +231,7 @@ github.com/inconshreveable/mousetrap v1.1.0 // indirect github.com/intel/goresctrl v0.13.0 // indirect github.com/jmoiron/sqlx v1.4.0 // indirect - github.com/klauspost/compress v1.20.1 // indirect + github.com/klauspost/compress v1.20.2 // indirect github.com/knqyf263/go-plugin v0.9.0 // indirect github.com/mdlayher/vsock v1.3.0 // indirect github.com/mitchellh/reflectwalk v1.0.2 // indirect
diff --git a/go.sum b/go.sum index 5b988e0..e1f9fa1 100644 --- a/go.sum +++ b/go.sum
@@ -430,8 +430,8 @@ github.com/jsimonetti/rtnetlink/v2 v2.0.1/go.mod h1:7MoNYNbb3UaDHtF8udiJo/RH6VsTKP1pqKLUTVCvToE= github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8= github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck= -github.com/klauspost/compress v1.20.1 h1:T7kKElXUMXrUJ2E9QhQhxFtcK5rPyLdsGZvdbLMPdiQ= -github.com/klauspost/compress v1.20.1/go.mod h1:LUdAzn7YLVvxLpc7y3V1m40wESHTgc1422pwwBSKYuI= +github.com/klauspost/compress v1.20.2 h1:v5tiZvm1KGLyg5d5oXdXe3lsSPrbEUiKoXGia//I7Qo= +github.com/klauspost/compress v1.20.2/go.mod h1:LUdAzn7YLVvxLpc7y3V1m40wESHTgc1422pwwBSKYuI= github.com/knqyf263/go-plugin v0.9.0 h1:CQs2+lOPIlkZVtcb835ZYDEoyyWJWLbSTWeCs0EwTwI= github.com/knqyf263/go-plugin v0.9.0/go.mod h1:2z5lCO1/pez6qGo8CvCxSlBFSEat4MEp1DrnA+f7w8Q= github.com/konsorten/go-windows-terminal-sequences v1.0.1/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
diff --git a/vendor/github.com/klauspost/compress/fse/compress.go b/vendor/github.com/klauspost/compress/fse/compress.go index 8c8baa4..2a7cd68 100644 --- a/vendor/github.com/klauspost/compress/fse/compress.go +++ b/vendor/github.com/klauspost/compress/fse/compress.go
@@ -659,7 +659,8 @@ if v >= 0 { total += int(v) } else { - total -= int(v) + // -1 takes one cell. Adding -v would let a wrapped -32768 pass. + total++ } } defer func() {
diff --git a/vendor/github.com/klauspost/compress/fse/decompress.go b/vendor/github.com/klauspost/compress/fse/decompress.go index 0c7dd4f..85b55db 100644 --- a/vendor/github.com/klauspost/compress/fse/decompress.go +++ b/vendor/github.com/klauspost/compress/fse/decompress.go
@@ -3,6 +3,7 @@ import ( "errors" "fmt" + "math" ) const ( @@ -123,6 +124,11 @@ remaining -= count gotTotal += count } + if count > math.MaxInt16 { + // Only one symbol filling a tableLog 15 table, which cannot be decoded. + // Truncated, it would leave the decoding table unwritten. + return fmt.Errorf("corruption detected (count %d > %d)", count, math.MaxInt16) + } s.norm[charnum&0xff] = int16(count) charnum++ previous0 = count == 0
diff --git a/vendor/github.com/klauspost/compress/huff0/decompress.go b/vendor/github.com/klauspost/compress/huff0/decompress.go index 7d0efa8..4832c96 100644 --- a/vendor/github.com/klauspost/compress/huff0/decompress.go +++ b/vendor/github.com/klauspost/compress/huff0/decompress.go
@@ -54,6 +54,10 @@ if len(in) < int(iSize) { return s, nil, fmt.Errorf("input too small for table, want %d bytes, have %d", iSize, len(in)) } + // The low nibble is the weights' FSE tableLog - 5, which the format limits to 6. + if in[0]&15+5 > 6 { + return s, nil, errors.New("corrupt input: weights tableLog too big") + } // FSE compressed weights s.fse.DecompressLimit = 255 hw := s.huffWeight[:]
diff --git a/vendor/github.com/klauspost/compress/zstd/dict.go b/vendor/github.com/klauspost/compress/zstd/dict.go index 67f40e7..92ab388 100644 --- a/vendor/github.com/klauspost/compress/zstd/dict.go +++ b/vendor/github.com/klauspost/compress/zstd/dict.go
@@ -219,6 +219,9 @@ if len(contents) == 0 { return nil, errors.New("no content provided") } + if o.Level < speedNotSet || o.Level >= speedLast { + return nil, fmt.Errorf("unknown encoder level %d", o.Level) + } d := dict{ id: o.ID, litEnc: nil,
diff --git a/vendor/github.com/klauspost/compress/zstd/snappy.go b/vendor/github.com/klauspost/compress/zstd/snappy.go index 36c56f3..06ed593 100644 --- a/vendor/github.com/klauspost/compress/zstd/snappy.go +++ b/vendor/github.com/klauspost/compress/zstd/snappy.go
@@ -69,6 +69,10 @@ // No CRC value is being generated and not all CRC values of the Snappy stream are checked. // However, it provides really fast recompression of Snappy streams. // The converter can be reused to avoid allocations, even after errors. +// +// Deprecated: Decode the stream with s2.NewReader, which reads Snappy streams, +// and compress the output with an Encoder. This validates the input and +// compresses much better. type SnappyConverter struct { r io.Reader err error @@ -373,6 +377,14 @@ offset = uint32(src[s-4]) | uint32(src[s-3])<<8 | uint32(src[s-2])<<16 | uint32(src[s-1])<<24 } + // A zstd match is at least zstdMinMatch bytes. A shorter copy + // cannot be represented as a sequence and would underflow the + // matchLen computation below, producing an out-of-range match + // length code. + if length < zstdMinMatch { + return ErrSnappyCorrupt + } + if offset <= 0 || blk.size+lits < int(offset) /*|| length > len(blk)-d */ { println("offset <= 0 || blk.size+lits < int(offset)", offset, blk.size+lits, int(offset), blk.size, lits)
diff --git a/vendor/modules.txt b/vendor/modules.txt index 127ddaf..7ffd5dc 100644 --- a/vendor/modules.txt +++ b/vendor/modules.txt
@@ -1027,7 +1027,7 @@ # github.com/jmoiron/sqlx v1.4.0 ## explicit; go 1.10 github.com/jmoiron/sqlx/types -# github.com/klauspost/compress v1.20.1 +# github.com/klauspost/compress v1.20.2 ## explicit; go 1.25 github.com/klauspost/compress github.com/klauspost/compress/flate