I've been fuzzing Python C extension modules for a small research project, and this one came up.
It reproduces with the binary wheel from a plain pip install zstandard.
Versions
zstandard 0.25.0 C backend, CPython 3.12.3, Ubuntu 24.04 x86_64, glibc 2.39.
Reproducer
import zstandard
zstandard.ZstdDecompressor().multi_decompress_to_buffer([])
An UBSan build identifies a division by zero at c-ext/decompressor.c:1237.
I would expect an empty frame list to return an empty result or raise an exception rather than terminate the interpreter.
I've been fuzzing Python C extension modules for a small research project, and this one came up.
It reproduces with the binary wheel from a plain
pip install zstandard.Versions
zstandard 0.25.0 C backend, CPython 3.12.3, Ubuntu 24.04 x86_64, glibc 2.39.
Reproducer
An UBSan build identifies a division by zero at
c-ext/decompressor.c:1237.I would expect an empty frame list to return an empty result or raise an exception rather than terminate the interpreter.