GitHub user Marcono1234 created a discussion: Potential bug in LZ4 decompression
Hello, in the upstream Lucene project there was a bug in the LZ4 decompression implementation, see https://github.com/apache/lucene/pull/15570. It seems the Lucene.NET implementation is affected in the same way: https://github.com/apache/lucenenet/blob/d70675c9d560cf8ba5953bc7e6d2bdf2c84971dc/src/Lucene.Net/Codecs/Compressing/LZ4.cs#L139-L140 Basically, an `Assert` here does not suffice because for malformed input the value can actually be 0. Instead it should throw an exception in that case. Otherwise with offset 0 it can happen that data from the given output buffer is emitted (or rather leaked) again as decompression result, which is a problem when reusing output buffers. Though I am not familiar with .NET and cannot say for sure that this implementation here is incorrect. If possible, could you please have a look? The reason why I am creating only a Discussion here is that your issue templates say that upstream Lucene bugs will be fixed here eventually as well, so no issue should be created here. Though I was wondering if this issue here is important enough (and the fix small enough) to fix this already now. GitHub link: https://github.com/apache/lucenenet/discussions/1238 ---- This is an automatically sent email for [email protected]. To unsubscribe, please send an email to: [email protected]
