Merge pull request #54054 from thaJeztah/bump_compress

vendor: github.com/klauspost/compress v1.20.2

go.mod

@@ -231,7 +231,7 @@ require (
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
 	github.com/intel/goresctrl v0.13.0 // indirect
 	github.com/jmoiron/sqlx v1.4.0 // indirect
-	github.com/klauspost/compress v1.20.1 // indirect
+	github.com/klauspost/compress v1.20.2 // indirect
 	github.com/knqyf263/go-plugin v0.9.0 // indirect
 	github.com/mdlayher/vsock v1.3.0 // indirect
 	github.com/mitchellh/reflectwalk v1.0.2 // indirect

go.sum

@@ -430,8 +430,8 @@ github.com/jsimonetti/rtnetlink/v2 v2.0.1 h1:xda7qaHDSVOsADNouv7ukSuicKZO7GgVUCX
 github.com/jsimonetti/rtnetlink/v2 v2.0.1/go.mod h1:7MoNYNbb3UaDHtF8udiJo/RH6VsTKP1pqKLUTVCvToE=
 github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8=
 github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
-github.com/klauspost/compress v1.20.1 h1:T7kKElXUMXrUJ2E9QhQhxFtcK5rPyLdsGZvdbLMPdiQ=
-github.com/klauspost/compress v1.20.1/go.mod h1:LUdAzn7YLVvxLpc7y3V1m40wESHTgc1422pwwBSKYuI=
+github.com/klauspost/compress v1.20.2 h1:v5tiZvm1KGLyg5d5oXdXe3lsSPrbEUiKoXGia//I7Qo=
+github.com/klauspost/compress v1.20.2/go.mod h1:LUdAzn7YLVvxLpc7y3V1m40wESHTgc1422pwwBSKYuI=
 github.com/knqyf263/go-plugin v0.9.0 h1:CQs2+lOPIlkZVtcb835ZYDEoyyWJWLbSTWeCs0EwTwI=
 github.com/knqyf263/go-plugin v0.9.0/go.mod h1:2z5lCO1/pez6qGo8CvCxSlBFSEat4MEp1DrnA+f7w8Q=
 github.com/konsorten/go-windows-terminal-sequences v1.0.1/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=

vendor/github.com/klauspost/compress/fse/compress.go

@@ -659,7 +659,8 @@ func (s *Scratch) validateNorm() (err error) {
 		if v >= 0 {
 			total += int(v)
 		} else {
-			total -= int(v)
+			// -1 takes one cell. Adding -v would let a wrapped -32768 pass.
+			total++
 		}
 	}
 	defer func() {

vendor/github.com/klauspost/compress/fse/decompress.go

@@ -3,6 +3,7 @@ package fse
 import (
 	"errors"
 	"fmt"
+	"math"
 )
 
 const (
@@ -123,6 +124,11 @@ func (s *Scratch) readNCount() error {
 			remaining -= count
 			gotTotal += count
 		}
+		if count > math.MaxInt16 {
+			// Only one symbol filling a tableLog 15 table, which cannot be decoded.
+			// Truncated, it would leave the decoding table unwritten.
+			return fmt.Errorf("corruption detected (count %d > %d)", count, math.MaxInt16)
+		}
 		s.norm[charnum&0xff] = int16(count)
 		charnum++
 		previous0 = count == 0

vendor/github.com/klauspost/compress/huff0/decompress.go

@@ -54,6 +54,10 @@ func ReadTable(in []byte, s *Scratch) (s2 *Scratch, remain []byte, err error) {
 		if len(in) < int(iSize) {
 			return s, nil, fmt.Errorf("input too small for table, want %d bytes, have %d", iSize, len(in))
 		}
+		// The low nibble is the weights' FSE tableLog - 5, which the format limits to 6.
+		if in[0]&15+5 > 6 {
+			return s, nil, errors.New("corrupt input: weights tableLog too big")
+		}
 		// FSE compressed weights
 		s.fse.DecompressLimit = 255
 		hw := s.huffWeight[:]

vendor/github.com/klauspost/compress/zstd/dict.go

@@ -219,6 +219,9 @@ func BuildDict(o BuildDictOptions) ([]byte, error) {
 	if len(contents) == 0 {
 		return nil, errors.New("no content provided")
 	}
+	if o.Level < speedNotSet || o.Level >= speedLast {
+		return nil, fmt.Errorf("unknown encoder level %d", o.Level)
+	}
 	d := dict{
 		id:      o.ID,
 		litEnc:  nil,

vendor/github.com/klauspost/compress/zstd/snappy.go

@@ -69,6 +69,10 @@ var (
 // No CRC value is being generated and not all CRC values of the Snappy stream are checked.
 // However, it provides really fast recompression of Snappy streams.
 // The converter can be reused to avoid allocations, even after errors.
+//
+// Deprecated: Decode the stream with s2.NewReader, which reads Snappy streams,
+// and compress the output with an Encoder. This validates the input and
+// compresses much better.
 type SnappyConverter struct {
 	r     io.Reader
 	err   error
@@ -373,6 +377,14 @@ func decodeSnappy(blk *blockEnc, src []byte) error {
 			offset = uint32(src[s-4]) | uint32(src[s-3])<<8 | uint32(src[s-2])<<16 | uint32(src[s-1])<<24
 		}
 
+		// A zstd match is at least zstdMinMatch bytes. A shorter copy
+		// cannot be represented as a sequence and would underflow the
+		// matchLen computation below, producing an out-of-range match
+		// length code.
+		if length < zstdMinMatch {
+			return ErrSnappyCorrupt
+		}
+
 		if offset <= 0 || blk.size+lits < int(offset) /*|| length > len(blk)-d */ {
 			println("offset <= 0 || blk.size+lits < int(offset)", offset, blk.size+lits, int(offset), blk.size, lits)
 

vendor/modules.txt

@@ -1037,7 +1037,7 @@ github.com/ishidawataru/sctp
 # github.com/jmoiron/sqlx v1.4.0
 ## explicit; go 1.10
 github.com/jmoiron/sqlx/types
-# github.com/klauspost/compress v1.20.1
+# github.com/klauspost/compress v1.20.2
 ## explicit; go 1.25
 github.com/klauspost/compress
 github.com/klauspost/compress/flate