seekable: reject seek tables exceeding ZSTD_SEEKABLE_MAXFRAMES

[evilgensec]

What

ZSTD_seekable_loadSeekTable() reads Number_Of_Frames from the seek table footer and uses it, unbounded, to size:

• the seek-table arithmetic — tableSize = sizePerEntry * numFrames (U32), and
• the entry array — malloc(sizeof(seekEntry_t) * (numFrames + 1)).

It never checks the value against ZSTD_SEEKABLE_MAXFRAMES, the limit the writer enforces in ZSTD_seekable_logFrame() (zstdseek_compress.c). The reader therefore accepts a frame count the writer would never emit.

Impact

A crafted seek table can set Number_Of_Frames close to 2^32.

• On platforms where size_t is 32-bit, sizeof(seekEntry_t) * (numFrames + 1) overflows. The entry array is under-allocated, but the cumulative-position loop still writes numFrames entries — a heap out-of-bounds write.
• On 64-bit platforms the multiplication is done in a 64-bit size_t, so it does not overflow; the allocation simply becomes huge and fails cleanly, so there is no out-of-bounds write. The U32 tableSize / frameSize arithmetic still wraps on these platforms.

The footer field is part of the trailer of an otherwise valid seekable archive, so a reader handed an attacker-influenced file reaches this path.

Fix

Reject Number_Of_Frames > ZSTD_SEEKABLE_MAXFRAMES before the size computations, mirroring the bound applied on write. With the limit in place neither sizePerEntry * numFrames (≤ 12 * 0x8000000) nor sizeof(seekEntry_t) * (numFrames + 1) can overflow a 32-bit size_t, and an over-large value is rejected with corruption_detected.

Testing

• contrib/seekable_format compiles clean under -Wall -Wextra -Werror.
• make -C contrib/seekable_format/tests test passes (round-trip, the two no-hang cases, empty-string magic, multi-decompress) — valid archives are unaffected, since the bound (0x8000000) is far above any frame count a writer produces.

[Copilot]

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Adds defensive validation when loading a seek table to prevent oversized numFrames values from causing unsafe allocations or arithmetic issues during decompression.

Changes:

• Introduces an early rejection when numFrames exceeds ZSTD_SEEKABLE_MAXFRAMES.
• Refactors tableSize / frameSize computation into separate variables after validation.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[evilgensec]

Closing this. I'll route the change through the project's preferred reporting process instead. Apologies for the noise.

[evilgensec]

Reopening to keep the fix available for review.