GHSA-259r-337f-4rfw — Compress/s2: Integer Overflow or Wraparound and Out-of-bounds Write in compress

Affected: Go: github.com/klauspost/compress

# Signed Integer Overflow in s2.NewDict

## Summary

A signed integer overflow vulnerability in `s2.NewDict()` allows an attacker to bypass repeat index validation by supplying a dictionary with a uvarint-encoded repeat value exceeding `MaxInt64`. When `Dict.Encode()` is subsequently called, the overflowed negative repeat value causes an out-of-bounds memory access via `unsafe.Pointer` arithmetic, crashing the process with SIGSEGV.

## Package

- **Name:** `github.com/klauspost/compress/s2` - **Ecosystem:** Go - **Affected versions:** <= v1.18.6 (all versions with `NewDict` function)

## Severity

**High (7.5)** — CVSS v3.1: `AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`

## Vulnerability

### Type - CWE-190: Integer Overflow or Wraparound - CWE-787: Out-of-bounds Write (via unsafe.Pointer)

### Description

The `NewDict()` function reads a uvarint from dictionary data and converts it to `int`:

```go r, n := binary.Uvarint(dict) // ... d.repeat = int(r) if d.repeat > len(dict) { return nil } ```

When `r` exceeds `MaxInt64` (9223372036854775807), `int(r)` overflows to a negative value. Since a negative number is never greater than a positive length, the validation check is bypassed.

When `Dict.Encode()` is called, the negative `repeat` value causes an integer overflow in `encodeBlockDictGo()`:

```go repeat := len(dict.dict) - dict.repeat // overflows: 62 - (-5758978476775341977) = huge positive candidate := len(dict.dict) - repeat + s // underflows to negative load32(dict.dic…

Most recent entries from all

GHSA-259r-337f-4rfw — Compress/s2: Integer Overflow or Wraparound and Out-of-bounds Write in compress