Files
Alexey MilovidovandClaude Opus 4.8 71fe4fc255 Update SZ3 to v3.3.2 and harden decompression against corrupted input
Updates the `contrib/sz3` submodule from the previous ClickHouse fork
(a snapshot of upstream's `sz3.3_develop`) to upstream SZ3 `v3.3.2`. The
two ClickHouse-specific fork patches ("fix segfault", "fix ub") are
already part of upstream `v3.3.2`, so nothing needed to be ported.

On top of `v3.3.2`, the fork branch `ClickHouse/v3.3.2` adds bounds
checking to the decompression path so that the `sz3_decompress_fuzzer`
can no longer read or write out of bounds on corrupted input (the reason
the codec was reverted in the first place, see issue #84345):

- `MemoryUtil` bounded reads throw instead of `assert` (which is a no-op
  in release builds).
- `HuffmanEncoder::load`/`decode` validate the node count, the tree size
  and the encoded length against the available buffer.
- `SZ_decompress` validates the header and payload sizes against the
  compressed buffer size.
- `Config::load` is bounds-checked against the size of the config blob,
  validates the dimension count and bit width, and checks that the
  product of the dimensions equals the element count.

The codec wrapper is reworked for the new `v3.3.2` wire format (the
serialized config moved to the end of the stream and `SZ_decompress`
itself checks the magic number and data version). It now lets SZ3
allocate the output buffer so a corrupted element count can not overflow
the destination, and validates the element count against the trusted
uncompressed size before copying. `version.hpp` is regenerated for
`v3.3.2`.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
2026-06-29 16:33:06 +00:00

37 lines
969 B
C++

//
// DO NOT MODIFY version.hpp, it is automatically generated by cmake
// Change the version numbers in CMakeLists.txt
//
#ifndef SZ3_VERSION_HPP
#define SZ3_VERSION_HPP
#include <sstream>
#define SZ3_MAGIC_NUMBER 0xF342F310
#define SZ3_NAME "SZ3"
#define SZ3_VER "3.3.2"
#define SZ3_VER_MAJOR 3
#define SZ3_VER_MINOR 3
#define SZ3_VER_PATCH 2
#define SZ3_VER_TWEAK 0
#define SZ3_DATA_VER "3.3.2"
inline uint32_t versionInt(const std::string& version) {
uint32_t major = 0, minor = 0, patch = 0;
char dot;
std::stringstream ss(version);
ss >> major >> dot >> minor >> dot >> patch;
return (major << 24) | (minor << 16) | (patch<<8);
}
inline std::string versionStr(uint32_t version) {
uint32_t major = (version >> 24) & 0xFF;
uint32_t minor = (version >> 16) & 0xFF;
uint32_t patch = (version >> 8) & 0xFF;
return std::to_string(major) + "." + std::to_string(minor) + "." + std::to_string(patch);
}
#endif //SZ3_VERSION_HPP