[PATCH 2/2] erofs-utils: libzstd: fix undefined behavior shift in setdictsize

Nithurshen nithurshen.dev at gmail.com
Sun Apr 19 23:16:04 AEST 2026


In erofs_compressor_libzstd_setdictsize(), if pclustersize_max is 0,
dict_size becomes 0, leading to undefined behavior when calling
ilog2(0). This results in an invalid bit shift (e.g., shifting
a 32-bit value by 63 bits), as reported by cppcheck.

Fix this by adding guards to ensure dict_size is non-zero before
performing power-of-two rounding and validation.

Signed-off-by: Nithurshen <nithurshen.dev at gmail.com>
---
 lib/compressor_libzstd.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/lib/compressor_libzstd.c b/lib/compressor_libzstd.c
index 6330f44..eb768de 100644
--- a/lib/compressor_libzstd.c
+++ b/lib/compressor_libzstd.c
@@ -123,10 +123,11 @@ static int erofs_compressor_libzstd_setdictsize(struct erofs_compress *c,
 		} else {
 			dict_size = min_t(u32, Z_EROFS_ZSTD_MAX_DICT_SIZE,
 					  pclustersize_max << 3);
-			dict_size = 1U << ilog2(dict_size);
+			if (dict_size)
+				dict_size = 1U << ilog2(dict_size);
 		}
 	}
-	if (dict_size != 1U << ilog2(dict_size) ||
+	if (!dict_size || dict_size != 1U << ilog2(dict_size) ||
 	    dict_size > Z_EROFS_ZSTD_MAX_DICT_SIZE) {
 		erofs_err("invalid dictionary size %u", dict_size);
 		return -EINVAL;
-- 
2.52.0



More information about the Linux-erofs mailing list